In the code scanning, I am facing the Client Potential XSS issue. Scan Result:enter image description here

Can anyone please provide me any solution on this?

Thanks, Ragav

  • I suspect, given that you are using AngularJS to insert the data into the page, this is a False Positive since Angular will substitute the values in double braces with "stringified versions" of the values (thereby avoiding XSS). Perhaps CheckMarx doesn't deal well with Angular usage? Worth noting that CheckMarx is far from perfect and we get a LOT of False Positives. We deal with these by adding a comment to the end of the line where the false positive is reported so you can see which are already understood as being false positives when you see the CheckMarx report. – Phil W May 3 '19 at 7:23
  • You can verify the False Positive nature by ensuring that one of the profile.text values is something like "</option><option>Fake" and see how that renders. – Phil W May 3 '19 at 7:26