[Cycode] Fix for SAST detections - Unsanitized user input in dynamic HTML insertion (XSS)#5
Conversation
…HTML insertion (XSS)
![cycode-security[bot]](https://avatars.githubusercontent.com/in/39308?s=60&v=4){kind=small}
| document.getElementById("previewRetrieval").src = "data:image/png;base64," + result; | ||
| var base64String = "data:image/png;base64," + result; | ||
| var sanitizedBase64String = sanitizeHtml(base64String); | ||
| document.getElementById("previewRetrieval").src = sanitizedBase64String; |
There was a problem hiding this comment.
❗Cycode: SAST violation: 'Unsanitized user input in dynamic HTML insertion (XSS)'.
Severity: High
Description
Unsanitized user input in dynamic HTML insertion can lead to Cross-Site Scripting (XSS) attacks. This vulnerability arises when user-provided data is directly inserted into the DOM without proper sanitization, potentially allowing attackers to execute malicious scripts.
Cycode Remediation Guideline
✅ Do
- Do use an HTML sanitization library to clean user input before inserting it into the HTML. This step helps prevent XSS attacks by removing or neutralizing any potentially harmful scripts.
import sanitizeHtml from 'sanitize-html';
const html = `<strong>${user.Input}</strong>`;
document.body.innerHTML = sanitizeHtml(html);📋 References
🎥 Learning materials (by Secure Code Warrior)
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_sast_ignore_here <reason> | Ignore this violation — applies to this violation only |
| #cycode_ai_remediation | Request remediation guidance using Cycode AI |
| #cycode_sast_false_positive <reason> | Mark as false positive — applies to this violation only |
| document.getElementById("randomCatPicture").src = "data:image/png;base64," + result; | ||
| var base64String = "data:image/png;base64," + result; | ||
| var sanitizedBase64String = sanitizeHtml(base64String); | ||
| document.getElementById("randomCatPicture").src = sanitizedBase64String; |
There was a problem hiding this comment.
❗Cycode: SAST violation: 'Unsanitized user input in dynamic HTML insertion (XSS)'.
Severity: High
Description
Unsanitized user input in dynamic HTML insertion can lead to Cross-Site Scripting (XSS) attacks. This vulnerability arises when user-provided data is directly inserted into the DOM without proper sanitization, potentially allowing attackers to execute malicious scripts.
Cycode Remediation Guideline
✅ Do
- Do use an HTML sanitization library to clean user input before inserting it into the HTML. This step helps prevent XSS attacks by removing or neutralizing any potentially harmful scripts.
import sanitizeHtml from 'sanitize-html';
const html = `<strong>${user.Input}</strong>`;
document.body.innerHTML = sanitizeHtml(html);📋 References
🎥 Learning materials (by Secure Code Warrior)
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_sast_ignore_here <reason> | Ignore this violation — applies to this violation only |
| #cycode_ai_remediation | Request remediation guidance using Cycode AI |
| #cycode_sast_false_positive <reason> | Mark as false positive — applies to this violation only |
| document.getElementById("preview").src = "data:image/png;base64," + result; | ||
| var base64String = "data:image/png;base64," + result; | ||
| var sanitizedBase64String = sanitizeHtml(base64String); | ||
| document.getElementById("preview").src = sanitizedBase64String; |
There was a problem hiding this comment.
❗Cycode: SAST violation: 'Unsanitized user input in dynamic HTML insertion (XSS)'.
Severity: High
Description
Unsanitized user input in dynamic HTML insertion can lead to Cross-Site Scripting (XSS) attacks. This vulnerability arises when user-provided data is directly inserted into the DOM without proper sanitization, potentially allowing attackers to execute malicious scripts.
Cycode Remediation Guideline
✅ Do
- Do use an HTML sanitization library to clean user input before inserting it into the HTML. This step helps prevent XSS attacks by removing or neutralizing any potentially harmful scripts.
import sanitizeHtml from 'sanitize-html';
const html = `<strong>${user.Input}</strong>`;
document.body.innerHTML = sanitizeHtml(html);📋 References
🎥 Learning materials (by Secure Code Warrior)
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_sast_ignore_here <reason> | Ignore this violation — applies to this violation only |
| #cycode_ai_remediation | Request remediation guidance using Cycode AI |
| #cycode_sast_false_positive <reason> | Mark as false positive — applies to this violation only |
| document.getElementById("previewRemoveUserInput").src = "data:image/png;base64," + result; | ||
| var base64String = "data:image/png;base64," + result; | ||
| var sanitizedBase64String = sanitizeHtml(base64String); | ||
| document.getElementById("previewRemoveUserInput").src = sanitizedBase64String; |
There was a problem hiding this comment.
❗Cycode: SAST violation: 'Unsanitized user input in dynamic HTML insertion (XSS)'.
Severity: High
Description
Unsanitized user input in dynamic HTML insertion can lead to Cross-Site Scripting (XSS) attacks. This vulnerability arises when user-provided data is directly inserted into the DOM without proper sanitization, potentially allowing attackers to execute malicious scripts.
Cycode Remediation Guideline
✅ Do
- Do use an HTML sanitization library to clean user input before inserting it into the HTML. This step helps prevent XSS attacks by removing or neutralizing any potentially harmful scripts.
import sanitizeHtml from 'sanitize-html';
const html = `<strong>${user.Input}</strong>`;
document.body.innerHTML = sanitizeHtml(html);📋 References
🎥 Learning materials (by Secure Code Warrior)
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_sast_ignore_here <reason> | Ignore this violation — applies to this violation only |
| #cycode_ai_remediation | Request remediation guidance using Cycode AI |
| #cycode_sast_false_positive <reason> | Mark as false positive — applies to this violation only |
1 participant
[Cycode] Fix for SAST detections - Unsanitized user input in dynamic HTML insertion (XSS)