Veracode identified CWE-80 & CWE-601 in spring-security-webauthn.js on line 199 in version 6.4.2 - Stack Overflow

admin管理员组

文章数量:1421582

I'm scanning one of our projects for vulnerabilities and Veracode identified CWE-80 & CWE-601 in spring-security-webauthn.js on line 199 for "Improper Neutralization of Script-Related HTML Tags in a Web Page" and "URL Redirection to Untrusted Site" respectively.

By performing the redirect inline without creating the variable it is able to pass the SAST scan as it no longer matches the pattern. This was done by slightly modifying the authenticateOrError function from this:

async function authenticateOrError(headers, contextPath, useConditionalMediation) {
  try {
    const redirectUrl = await webauthn.authenticate(headers, contextPath, useConditionalMediation);
    window.location.href = redirectUrl;
  } catch (err) {
    console.error(err);
    window.location.href = `${contextPath}/login?error`;
  }
}

to this:

async function authenticateOrError(headers, contextPath, useConditionalMediation) {
  try {
    window.location.href = await webauthn.authenticate(headers, contextPath, useConditionalMediation);
  } catch (err) {
    console.error(err);
    window.location.href = `${contextPath}/login?error`;
  }
}

My assumption is that the original code itself is innocuous and shouldn't be an issue. Where this doesn't change any functionality it may be worth the addition and remove the false positive in the scan results. But it's definitely something that should be validated.

Thoughts and feedback are welcome

本文标签： Veracode identified CWE80 amp CWE601 in springsecuritywebauthnjs on line 199 in version 642Stack Overflow