Veracode Scan: jQuery html method showing Improper Neutralization of Script-Related HTML Tags in a Web Page issue

user_790329 0
Viewed 707

Veracode is pointing out the issue Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in the below line.

$('#SummaryDiv').html(data);

$.ajax({
            url: 'Target_URL',
            type: 'GET',                
            datatype: "json",
            traditional: true,
            cache: false
        }).done(function (data) {               
            $('#SummaryDiv').html(data);

I am binding the MVC View Result to DIV via the ajax call. Checked the articles in the stackoverflow but no luck. What could be the possible solution to fix this veracode issue.

veracode xss jquery ajax javascript
2 Answers

So you are taking json and putting it directly into a div? I guess that means you don't expect the response to contain any HTML to be rendered, but rather want the JSON displayed as is. So the fix would be to use jQuery's .text() instead of .html()

Edit: If you need to render it as HTML, you should sanitize it with DOMPurify first.

Erlend_57460
user_7903290
Related