Question

我们在nodejs中有以下代码

int i = _.get（req.body，＆＃34; i＆＃34;） res.send（ⅰ）;

当checkmarx找到上面的代码时，它说我应该进行消毒和验证。有人可以帮忙解决这个问题吗？

提前致谢

Answer 1

如果你的意思是：

int i = _.get(req.body, "i");
res.send(i);

然后，Checkmarx似乎设法找到了一个反映的XSS漏洞。

当您在来自用户的请求中收到不受信任的输入时，它可能包含可能在响应中发送并在客户端运行的恶意脚本。这称为Reflected Cross Site Scripting（XSS）。

预防取决于许多因素。 OWASP写了一篇很好的指南： https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet

Answer 2

int i = _.get(req.body, "i") res.send(i);
Issue : 
Here you are setting your response fetching value from request body, which embeds untrusted data in the generated output with send. This untrusted data is embedded straight into the output without proper sanitization.

Solution :
Sanitize request body attributes before setting it to response
requestSanitizer.setOptions({
    body :{
        name : [validator.escape,validator.ltrim],
        test : [validator.ltrim]
    }
});

you must first import these packages : 
var requestSanitizer = require('request-sanitizer')();
var validator = requestSanitizer.validator;

and then finally set requestSanitizer  as an additional param to API call

CheckMarx给出的变量应该进行消毒和验证

2 个答案: