How to fix Reflected XSS vulnerability in my node.js application

Question

I am writing the backend of an application using express in node.js. Checkmarx highlights this issue: Improper Neutralization of Input During Web Page Generation

The line of code highlighted: const token = req.params.company2tftoken;

What can I do to fix this? Any article will also work.

securecodeninja · Accepted Answer · 2021-03-06T17:35:05.330

2

Here's a quick intro to what Reflected XSS is and what harm this vulnerability can do to your Node app

In general, one of the ways to prevent XSS is to output encode/escape. Depending on the contextual output (URL, javascript, HTML) where req.params.company2tftoken might end, will determine what function to use. I'm assuming URL so you may try with URL encoding using the querystring.escape method

const token = querystring.escape(req.params.company2tftoken);

edited Mar 06 '21 at 17:35

answered Mar 04 '21 at 04:25

securecodeninja

2,497
3
16
22

Hi @Roman , I am also getting this checkmarx vulnerability about reflected XSS whenever I am using request.session in the code, any solution for that? – Sarika Rajput May 09 '21 at 07:12
Hi @SarikaRajput the solution would be the same. HTML, javascript or URL encode the session value – securecodeninja May 10 '21 at 01:36
I am also getting this checkmarx vulnerability about reflected XSS whenever I am using request.param in the code, any solution for that? – Asiri Hewage Jun 30 '21 at 09:08
Finally this resolved CheckMarx issue. Don't know why hahaa :) thanks for the recommendation man! – Asiri Hewage Jun 30 '21 at 09:46
1

@AsiriH. glad that I could be of help :) feel free to mark this answer as useful – securecodeninja Jun 30 '21 at 18:10

score 0 · Answer 2 · answered May 26 '22 at 17:59

0

You can also use xss-filters npm library

const xssFilters = require('xss-filters');

const token = xssFilters.inHTMLData(req.params.company2tftoken);

answered May 26 '22 at 17:59

Sunil Kumar Singh

301
3
15

How to fix Reflected XSS vulnerability in my node.js application

2 Answers2

Linked