Skip to content

HP Fortify Static scan results show over 130+ XSS vulnerabilities #16

@JPCoffee

Description

@JPCoffee

I have been using the jqGrid library since Trirand. I recently upgraded by project to the free-jqGrid 4.15.5 version, and use the autoencoder option for the grid. However, when our new security team runs the HP Fortify scan on the source code, it reports a great many XSS vulnerabilities. One example:
Cross-Site Scripting: DOM Critical
Package: Scripts
Scripts/jquery.jqgrid.src.js, line 6659 (Cross-Site Scripting: DOM) Critical
Issue Details
Kingdom: Input Validation and Representation
Scan Engine: SCA (Data Flow)
Source Details
Source: Read $t.rows['?']
From: lambda
File: Scripts/jquery.jqgrid.src.js:6678
6675 // The event could be inside of frozen div.
6676 // Thus tr could be the same as trFrozen (frozenRows[pt.rowIndex])
6677 // We normalize it based on the rowIndex.
6678 pt = $t.rows[pt.rowIndex];
6679 }
6680 }
6681 }
Sink Details
Sink: environment~object.$()
Enclosing Method: selectUnselectRowInTable()
File: Scripts/jquery.jqgrid.src.js:6659
Taint Flags: DATABASE, XSS
6656 selectUnselectRowInTable = function (tr) {
6657 $(tr)method.attr(attributes);
6658 if (iColCb !== undefined) { // p.multiselect or p.multiselectCheckboxes
6659 $(tr.cells[iColCb]).children("input.cbox").prop("checked", toSelect);
6660 }
6661 };
6662 selectUnselectRowInTable(tr1);

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions