AMathuria172594 (Community Member) asked a question.
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (CWE ID
80)
We are trying to use
org.owasp.esapi.ESAPI.validator().getValidInput(String context, String input, String type, int maxLength, boolean allowNull)
/**
* Validates data received from the browser and returns a safe version.
* Double encoding is treated as an attack. The default encoder supports
* html encoding, URL encoding, and javascript escaping. Input is
* canonicalized by default before validation.
*
* @param context A descriptive name for the field to validate. This is used for error facing validation messages and element identification.
* @param input The actual user input data to validate.
* @param type The regular expression name which maps to the actual regular expression from "ESAPI.properties".
* @param maxLength The maximum post-canonicalized String length allowed.
* @param allowNull If allowNull is true then a input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException.
* @return The canonicalized user input.
* @throws ValidationException
* @throws IntrusionException
*/
but Veracode doesn't accepting as a solution to resolve this vulnerability
We would like to what is missing here?
.png){kind=logo}
Hi @AMathuria172594 (Community Member) ,
While we encourage adding input validation, Veracode Static Analysis does not support ESAPI validators as Supported Cleansing Functions. For a full list of our Supported Cleansing Functions please visit our Help Centre: https://help.veracode.com/reader/4EKhlLSMHm5jC8P8j3XccQ/IiF_rOE79ANbwnZwreSPGA .
If you are unable to use an appropriate supported cleansing function and must rely only on input validation please mitigate the flaw ( https://help.veracode.com/reader/DGHxSJy3Gn3gtuSIN2jkRQ/~p4MSKOS8F8X8h0KwFTKoQ ) and have this mitigation proposal reviewed by your security team.
Please let me know if you have any remaining questions or concerns.
Thank you,
Boy Baukema
Thanks for the information, I will try to figure it out for more. Keep sharing such informative post keep suggesting such post.
Have you found a solution for this, I have exactly the same.