In the code scanning, I am facing the Client Potential XSS issue. Scan Result:enter image description here

Can anyone please provide me any solution on this?

Thanks, Ragav

closed as off-topic by Raul, Derek F, Jayant Das, glls, battery.cord May 3 at 13:42

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions on problems in code you've written must describe the specific problem and include valid code to reproduce it. For help writing short, self-contained syntactically-valid examples, see: SSCCE.org" – Raul, Derek F, Jayant Das, glls, battery.cord
If this question can be reworded to fit the rules in the help center, please edit the question.

  • I suspect, given that you are using AngularJS to insert the data into the page, this is a False Positive since Angular will substitute the values in double braces with "stringified versions" of the values (thereby avoiding XSS). Perhaps CheckMarx doesn't deal well with Angular usage? Worth noting that CheckMarx is far from perfect and we get a LOT of False Positives. We deal with these by adding a comment to the end of the line where the false positive is reported so you can see which are already understood as being false positives when you see the CheckMarx report. – Phil W May 3 at 7:23
  • You can verify the False Positive nature by ensuring that one of the profile.text values is something like "</option><option>Fake" and see how that renders. – Phil W May 3 at 7:26