Status/Resolution/Reason: Closed/Fixed/
Reporter/Name(from Bugbase): Adam Cameron / Adam Cameron (Adam Cameron)
Created: 03/09/2016
Components: Security Analyzer
Versions: 2016
Failure Type: Unspecified
Found In Build/Fixed In Build: Alpha_v31 /
Priority/Frequency: Normal / Unknown
Locale/System: English / Win All
Vote Count: 0
I put this code through the security scanner:
<cfscript>
unscopedMessage = "hi";
writeOutput(unscopedMessage);
variables.scopedMessage = "hi";
writeOutput(variables.scopedMessage);
variables.messageWithFunction = ucase(variables.scopedMessage);
writeOutput(variables.messageWithFunction);
variables.messageFollowingGuidance = encodeForHtml(unscopedMessage);
writeOutput(variables.messageFollowingGuidance);
</cfscript>
This line is singled-out with an XSS warning:
writeOutput(variables.messageWithFunction);
Why’s that? It’s as if CF thinks that calling ucase() on its original variable (which the scanner had no problem with) somehow exposes it to XSS?
S Preethi has come back with this comment:
The Security Analyzer flags warnings when functions are involved.
Since this is an in-built function, it is a valid scenario for not flagging it as an error/warning.
Please do raise a bug for the same. Thank You for the input!
Consider it raised.
----------------------------- Additional Watson Details -----------------------------
Watson Bug ID: 4126688
External Customer Info:
External Company: Straker Interactive
External Customer Name: Adam Cameron
External Customer Email: CAMERON.ADAM@GMAIL.COM
External Test Config:Attachments:
Comments: