Title:
Inconsistent XSS markings for built-in-functions (BIF) that return integers
| View in TrackerStatus/Resolution/Reason: Closed/Withdrawn/Duplicate
Reporter/Name(from Bugbase): David Epler / David Epler (David Epler)
Created: 03/09/2016
Components: Security Analyzer
Versions: 2016
Failure Type:
Found In Build/Fixed In Build: CF2016_Final /
Priority/Frequency: Major / All users will encounter
Locale/System: ALL / Win 2008 Server R2 64 bit
Vote Count: 0
Duplicate ID: CF-4126413
Problem Description:
Given the code:
<cfparam name="url.id" default="1.5" type="numeric" />
<cfoutput>
#ceiling(url.id)#<br>
#floor(url.id)#<br>
#round(url.id)#<br>
</cfoutput>
Actual Result:
The security analyzer marks the lines with ceiling() and floor() as XSS, Warning, Low and does not mark the round() line.
Expected Result:
It should not mark any of the lines since the functions return an integer. All BIFs that return an integer should not be marked as XSS vulnerability.
Any Workarounds:
None.
----------------------------- Additional Watson Details -----------------------------
Watson Bug ID: 4126912
External Customer Info:
External Company:
External Customer Name: David Epler
External Customer Email:Attachments:
Comments: