-
Notifications
You must be signed in to change notification settings - Fork 15
Description
I have been using the jqGrid library since Trirand. I recently upgraded by project to the free-jqGrid 4.15.5 version, and use the autoencoder option for the grid. However, when our new security team runs the HP Fortify scan on the source code, it reports a great many XSS vulnerabilities. One example:
Cross-Site Scripting: DOM Critical
Package: Scripts
Scripts/jquery.jqgrid.src.js, line 6659 (Cross-Site Scripting: DOM) Critical
Issue Details
Kingdom: Input Validation and Representation
Scan Engine: SCA (Data Flow)
Source Details
Source: Read $t.rows['?']
From: lambda
File: Scripts/jquery.jqgrid.src.js:6678
6675 // The event could be inside of frozen div.
6676 // Thus tr could be the same as trFrozen (frozenRows[pt.rowIndex])
6677 // We normalize it based on the rowIndex.
6678 pt = $t.rows[pt.rowIndex];
6679 }
6680 }
6681 }
Sink Details
Sink: environment~object.$()
Enclosing Method: selectUnselectRowInTable()
File: Scripts/jquery.jqgrid.src.js:6659
Taint Flags: DATABASE, XSS
6656 selectUnselectRowInTable = function (tr) {
6657 $(tr)method.attr(attributes);
6658 if (iColCb !== undefined) { // p.multiselect or p.multiselectCheckboxes
6659 $(tr.cells[iColCb]).children("input.cbox").prop("checked", toSelect);
6660 }
6661 };
6662 selectUnselectRowInTable(tr1);