SV.XSS.DB

This error is reported when cross-site scripting from the application database is detected. Cross-site scripting vulnerabilities occur when unchecked user input is reflected back to the web interface.

Vulnerability and risk

An XSS or cross-site scripting vulnerability results from using unchecked user input in information used in the web interface. This data can contain arbitrary content such as HTML and SCRIPT tags. If this information is displayed for other users of the system, these scripts can be used to manipulate the user's session, direct them to other web sites, perform "phishing" attacks or run other malicious script content. This vulnerability is common on message boards of web applications where users can post information back to other users. This content must be closely screened to prevent the injection of HTML or SCRIPT tags into the output seen by other users.

Klocwork security vulnerability (SV) checkers identify calls that create potentially dangerous data; these calls are considered unsafe sources. An unsafe source can be any data provided by the user, since the user could be an attacker or has the potential for introducing human error.

Mitigation and prevention

Cross-site scripting vulnerabilities, in general, can be prevented by validating any and all input from outside the application (user input, file input, system parameters, etc.). Validation should include length and content. Typically only alphanumeric characters are needed (i.e., A-Za-z, 0-9). Any other accepted characters should be escaped. In particular for XSS vulnerabilities, no tags should be allowed in the user input. This validation should be done at each source of data, such as when each parameter is read from the HTTP request. Validation should be done at the server side; client-side validation is not enough to protect against XSS, since users can send raw HTTP packets without the need of a client browser.

Example 1

Copy

15
16
17
18
19
20
     protected void printComment(Connection conn, ServletOutputStream out, String user) throws SQLException, IOException {
         PreparedStatement pr = conn.prepareStatement("SELECT * FROM comms WHERE user = ?");
         pr.setString(0, user);
         String comment = pr.executeQuery().getString("comment");
         out.println("Comments: " + comment);
     }

SV.XSS.DB is reported for line 19: 'comment' contains data coming from the database (line 18). On line 19 it is used to render a web page. This means that information previously stored in the database is used unchecked to render a web page; this information may contain arbitrary HTML and JavaScript content. To exploit this vulnerability, a database injection vulnerability must also exist.

Related checkers

External guidance

Security training

Application security training materials provided by Secure Code Warrior.

Cross Site Scripting Training Video - Test your skills with a training example

Extension

This checker can be extended through the Klocwork knowledge base. See Tuning Java analysis for more information.