3

I've just completed my first Veracode static scan of an asp.net mvc web application, and Veracode found dozens of CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page flaws.

Nearly all of them involve the use of the jquery html() method. Our pattern is to make a $.ajax() call in javascript, and in the success event display the results of the $.ajax call in an html element, like so:

success: function(data) {
    $('#elementid').html(data);
}

In most cases these $.ajax() calls are to MVC controller methods that return MVC partial views, chock full of html tags and etc.

How would we alter our javascript so that calls like this are not flagged as CWE-80 flaws by Veracode? Can we still do client-side $.ajax calls to controller methods that return blobs of html and pass muster with Veracode?

Tom Regan
  • 3,580
  • 4
  • 42
  • 71

2 Answers2

2

I scheduled a Veracode consultation and learned that Veracode simply marks all $.html() calls as flaws of Medium severity. There are two courses of action open to us:

  1. Mark the flaw as "mitigated" with an explanation, or
  2. Change the code to remove all calls to $.html().

We are choosing to mark all of these flaws as "mitigated."

Tom Regan
  • 3,580
  • 4
  • 42
  • 71
1

Granted this post is almost 2 years old, yet I hit on it as I just ran into the same issue. Mitigation was not an option for us. Luckily, we found the JavaScript WebAPI on Mozilla Developer Network.

In our case we are creating a dropdown list and appending each option via jquery append(). The Web API sanitizes the data enough that Veracode should allow the append or html method calls.

https://developer.mozilla.org/en-US/docs/Web/API

dj_datum
  • 11
  • 1
  • Thanks @dj_datum. What exactly did you do to "sanitize" you data? And when you say "should," does that mean you've not run the static scan yet using this web api? – Tom Regan May 27 '20 at 00:33
  • We just had a Veracode consult and our contact was happy with us using the WebAPI which did pass the scan. Using the WebAPI parses the data enough that using the jquery methods are not flagged as dangerous. To sanitize we tried using a regular expression to scan the text parameters to conform to text with no characters besides a comma. The scan still marked it as a fail. – dj_datum May 29 '20 at 12:25
  • @dj_datum Which Web API did you use? – johnborges Feb 03 '22 at 18:50