SV.TAINTED.XSS.REFLECTED

Cross-site Scripting Vulnerability

This checker reports potential cross-site scripting issues for CGI scripts (web servers that use a Common Gateway Interface). In particular, this checker reports a defect whenever a tainted string, received from the QUERY_STRING environment variable, through call to the getenv() function, is passed to a function that writes it to the stdout stream.

Vulnerability and risk

Cross-site scripting (XSS) is a type of web application security vulnerability. Cross-site scripting attacks enable attackers to inject scripts coming from a different site into legitimate web pages. In a web server program, passing the HTTP request directly to the web page is a potential for the reflected use case scenario of cross-site scripting vulnerability.

Mitigation and prevention

Mitigating reflected cross-site scripting issues depends on where on the generated HTML page the untrusted data is inserted. In general, using escaping the untrusted data works well for HTML Element content (similar to the fixed example in this documentation). However, for more complete information on how to prevent cross-site scripting, see the OWASP documentation.

Vulnerable code example

1
2
3
4
5
6
7
8
   #include <iostream>
   #include <string>
   using namespace std;
   void vulnerableServer() {
      string query = getenv("QUERY_STRING");
      cout << "Viewing query ";
      cout << query << endl;    
   }

In the above example, an attacker can insert a script in the query that, when displayed on the web page, starts running and can collect sensitive information from the system.

Klocwork produces a SV.TAINTED.XSS.REFLECTED defect at line 7, indicating that “Unvalidated string 'query' is received from the QUERY_STRING environment variable through a call to 'getenv' at line 5 that is being written to stdout through 'cout' at line 7. This allows for a cross-site scripting vulnerability.”

Fixed code example

1
2
3
4
5
6
7
8
9
10
   #include <iostream>
   #include <string>
   using namespace std;
   string validate(string &query);
   void secureServer() {
      string query = getenv("QUERY_STRING");
      cout << "Viewing query ";
      string validated_query = validate(query);
      cout << validated_query << endl;    
  }

In this example, the checker will not report the defect SV.TAINTED.XSS.REFLECTED because the tainted string ‘query’ has been validated at line 8. The function validate() at line 8 is a custom-implemented function (the prototype is at line 4) that escapes special characters in the query string to prevent cross-site scripting from occurring. This is a simple way to remove the potential for cross-site scripting.

External guidance

• CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
• CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
• CWE-896: None
• OWASP A3:2021 Injection

Security training

Application security training materials provided by Secure Code Warrior.

• Cross Site Scripting Training Video - Test your skills with a training example

Extension