SV.XSS.REF

Cross Site Scripting (Reflected XSS)

This error indicates cross-site scripting from the application database. Cross-site scripting vulnerabilities occur when unchecked user input is reflected back to the web interface.

As of release 2023.2, this checker supports Jakarta EE.

Vulnerability and risk

An XSS or cross-site scripting vulnerability results from using unchecked user input in information used in the web interface. This data can contain arbitrary content such as HTML and SCRIPT tags. If this information is displayed for other users of the system, these scripts can be used to manipulate the user's session, direct them to other web sites, perform "phishing" attacks or run other malicious script content. This vulnerability is common on message boards of web applications where users can post information back to other users. This content must be closely screened to prevent the injection of HTML or SCRIPT tags into the output seen by other users.

Klocwork security vulnerability (SV) checkers identify calls that create potentially dangerous data; these calls are considered unsafe sources. An unsafe source can be any data provided by the user, since the user could be an attacker or has the potential for introducing human error.

Mitigation and prevention

Cross-site scripting vulnerabilities, in general, can be prevented by validating any and all input from outside the application (user input, file input, system parameters, etc.). Validation should include length and content. Typically only alphanumeric characters are needed (i.e., A-Za-z, 0-9). Any other accepted characters should be escaped. In particular for XSS vulnerabilities, no tags should be allowed in the user input. This validation should be done at each source of data, such as when each parameter is read from the HTTP request. Validation should be done at the server side; client-side validation is not enough to protect against XSS, since users can send raw HTTP packets without the need of a client browser.

Vunerable code example 1

Copy

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
     import javax.servlet.http.*;
     protected void doPost(HttpServletRequest req, HttpServletResponse res) throws ServletException, IOException {
         String action = req.getParameter("action");
         if ("chart".equals(action)) {
             renderChart(res.getOutputStream());
         } else if ("table".equals(action)) {
             renderTable(res.getOutputStream());
         } else {
             throw new ServletException("Cannot find action " + action);
         }
     }
 
     private void renderTable(ServletOutputStream outputStream) {
         //...
     }
 
     private void renderChart(ServletOutputStream outputStream) {
         //...
     }

Klocwork reports an SV.XSS.REF defect for line 9, indicating: 'action' contains data coming from an HTTP request parameter and might be tainted (line 3). This value is used as a message for the ServletException thrown on line 9. This message will be rendered in the browser. This is a reflected cross-site scripting (Reflected XSS) vulnerability: unvalidated user input is used for web application output, which may contain arbitrary HTML and JavaScript.

Vunerable code example 2

Copy

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
     import jakarta.servlet.http.*;
     protected void doPost(HttpServletRequest req, HttpServletResponse res) throws ServletException, IOException {
         String action = req.getParameter("action");
         if ("chart".equals(action)) {
             renderChart(res.getOutputStream());
         } else if ("table".equals(action)) {
             renderTable(res.getOutputStream());
         } else {
             throw new ServletException("Cannot find action " + action);
         }
     }
 
     private void renderTable(ServletOutputStream outputStream) {
         //...
     }
 
     private void renderChart(ServletOutputStream outputStream) {
         //...
     }

Klocwork reports an SV.XSS.REF defect for line 9, indicating: 'action' contains data coming from an HTTP request parameter and might be tainted (line 3). This value is used as a message for the ServletException thrown on line 9. This message will be rendered in the browser. This is a reflected cross-site scripting (Reflected XSS) vulnerability: unvalidated user input is used for web application output, which may contain arbitrary HTML and JavaScript.

Related checkers

SV.XSS.DB

External guidance

Security training

Application security training materials provided by Secure Code Warrior.

Cross Site Scripting Training Video - Test your skills with a training example

Extension

This checker can be extended through the Klocwork knowledge base. See Tuning Java analysis for more information.