WhiteSource SAST Vulnerability (Risk: Medium, Type: Cross-Site Scripting)

[shaimael]

WhiteSource SAST Finding (Scan-.-2022/03/14 01:40:45 PM): Vulnerability Type: Cross-Site Scripting Vulnerable Sink Call: writer.write(getMsg("label.login.user.id", locale) + ": " + userid); Input Source: session.getAttribute("userid") Vulnerable Project File: Java-Demo/src/main/java/org/t246osslab/easybuggy/core/servlets/AbstractServlet.java Function Call Stack: 0 - writer.write (Line: 82) - Java-Demo/src/main/java/org/t246osslab/easybuggy/core/servlets/AbstractServlet.java 1 - responseToClient (Line: 55) - Java-Demo/src/main/java/org/t246osslab/easybuggy/vulnerabilities/CodeInjectionServlet.java

User Input Flow: 0 - session.getAttribute("userid") (Line: 34) - Java-Demo/src/main/java/org/t246osslab/easybuggy/core/servlets/AbstractServlet.java 1 - userid (Line: 34) - Java-Demo/src/main/java/org/t246osslab/easybuggy/core/servlets/AbstractServlet.java

Description: Tainted input "session.getAttribute("userid")" was received in line 34 of the file Java-Demo/src/main/java/org/t246osslab/easybuggy/core/servlets/AbstractServlet.java:

String userid = (String) session.getAttribute("userid");

the value is then passed on to the value of "userid" in line 34 of the file Java-Demo/src/main/java/org/t246osslab/easybuggy/core/servlets/AbstractServlet.java

String userid = (String) session.getAttribute("userid");

and finally passed unsanitized into a sensitive sink function "writer.write" in line 82 of the file Java-Demo/src/main/java/org/t246osslab/easybuggy/core/servlets/AbstractServlet.java, causing a Medium risk Cross-Site Scripting vulnerability:

writer.write(getMsg("label.login.user.id", locale) + ": " + userid);

Mitigation Recommendations:

• Escape HTML before inserting untrusted data into element content
• Escape attribute before inserting untrusted data into HTML common attributes
• Escape JavaScript before inserting untrusted data into JavaScript data values
• Escape CSS and strictly validate before inserting untrusted data into HTML style property values
• Escape URL before inserting untrusted data into HTML URL parameter values
• Use HTML policy engine to validate or clean user-driven HTML in an outbound way
• Use HTTPOnly cookie flag

Further Reading:

• https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)