1

I use the Veracode Platform to analyze some projects. I currently have a project in Angular. I have a select list in my application.

Veracode informs that by selecting an option it is possible to execute a malicious JavaScript, called XSS. As there are many XSS payloads and the simplest JavaScript injections don't work, I need input from more experienced developers.

This my code:

<kendo-treeview
    class="po-md-12 po-mt-1 po-mb-1"
    kendoTreeViewDragAndDrop
    kendoTreeViewDragAndDropEditing
    kendoTreeViewExpandable
    [expandBy]="'id'"
    [(expandedKeys)]="expandedKeys"
    kendoTreeViewHierarchyBinding
    [childrenField]="'children'"
    [(nodes)]="treeviewItems"
    [textField]="'name'"
    kendoTreeViewSelectable
    [(selectedKeys)]="selectedKeys"
    (nodeDrop)="handleDrop($event)"
    (removeItem)="handleRemovedNode()"
    (selectionChange)="handleSelection($event)"
    [selectBy]="'id'"
    [isSelected]="isItemSelected"
  >

The vulnerable line is this:

(selectionChange)="handleSelection($event)"

Is it possible to run a JavaScript or exploit XSS in this code? As there are many JavaScript payloads to exploit XSS vulnerabilities, it is not possible to inject JavaScript to exploit XSS?

halfer
  • 19,824
  • 17
  • 99
  • 186

0 Answers0