I'm working on a program, but veracode is detecting that part of my code is vulnerable to XSS CWE 80.
Here is the snippet that is being flagged:
ltLinkDoc.Text =
'<script>$(window).bind("load", function(){ setTimeout(function() { ' +
safeScript +
" }, 100); });</script>";
Does anyone know why this part of the code is vulnerable, and how I can secure it?
Here is my full code:
Session.Remove("linkdoc");
var strWebDavJs = HttpUtility.JavaScriptStringEncode(strWebDav);
var generateLinkDialogJs = HttpUtility.JavaScriptStringEncode(
(_settingPageInPopup != null
? _settingPageInPopup.GenerateLinkDialog
: true
).ToString(),
);
var isShowSuccussfulOrFailedJs = HttpUtility.JavaScriptStringEncode(
IsShowSuccussfulOrFailed,
);
var isDocOrDestCheckedJs = HttpUtility.JavaScriptStringEncode(
rdoDocumentInfile.Checked || IsDestinationFileChecked() ? "true" : "",
);
var safeScript = string.Format(
'CloseAndSendLinkToParent("{0}", "{1}", "{2}", "{3}");',
strWebDavJs,
generateLinkDialogJs,
isShowSuccussfulOrFailedJs,
isDocOrDestCheckedJs,
);
ltLinkDoc.Text =
'<script>$(window).bind("load", function(){ setTimeout(function() { ' +
safeScript +
" }, 100); });</script>";