Skip to content

[Cycode] Fix for SAST detections - Unsanitized user input in dynamic HTML insertion (XSS) #5

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
cycode-security wants to merge 1 commit into
base: main
Choose a base branch
from
Open

[Cycode] Fix for SAST detections - Unsanitized user input in dynamic HTML insertion (XSS) #5

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 16 additions & 5 deletions src/main/resources/lessons/pathtraversal/js/path_traversal.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@

webgoat.customjs.profileUpload = function () {

var picture = document.getElementById("uploadedFile").files[0];
Expand All @@ -8,10 +9,12 @@
formData.append("password", $("#password").val());
return formData;
}

Check failure on line 12 in src/main/resources/lessons/pathtraversal/js/path_traversal.js

View check run for this annotation

Cycode Security / Cycode: SAST

src/main/resources/lessons/pathtraversal/js/path_traversal.js#L12 

Unsanitized user input in dynamic HTML insertion (XSS) found
webgoat.customjs.profileUploadCallback = function () {
$.get("PathTraversal/profile-picture", function (result, status) {
document.getElementById("preview").src = "data:image/png;base64," + result;
var base64String = "data:image/png;base64," + result;
var sanitizedBase64String = sanitizeHtml(base64String);
document.getElementById("preview").src = sanitizedBase64String;
Copy link
Copy Markdown
Author

@cycode-security cycode-security Bot Mar 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

❗Cycode: SAST violation: 'Unsanitized user input in dynamic HTML insertion (XSS)'.

Severity: High

Description

Unsanitized user input in dynamic HTML insertion can lead to Cross-Site Scripting (XSS) attacks. This vulnerability arises when user-provided data is directly inserted into the DOM without proper sanitization, potentially allowing attackers to execute malicious scripts.

Cycode Remediation Guideline

✅ Do

  • Do use an HTML sanitization library to clean user input before inserting it into the HTML. This step helps prevent XSS attacks by removing or neutralizing any potentially harmful scripts.
import sanitizeHtml from 'sanitize-html';

const html = `<strong>${user.Input}</strong>`;
document.body.innerHTML = sanitizeHtml(html);

📋 References

🎥 Learning materials (by Secure Code Warrior)

Tell us how you wish to proceed using one of the following commands:

Tag Short Description
#cycode_sast_ignore_here <reason> Ignore this violation — applies to this violation only
#cycode_ai_remediation Request remediation guidance using Cycode AI
#cycode_sast_false_positive <reason> Mark as false positive — applies to this violation only

⚠️ When commenting on Github, you may need to refresh the page to see the latest updates.

});
}

Expand All @@ -27,7 +30,9 @@

webgoat.customjs.profileUploadCallbackFix = function () {
$.get("PathTraversal/profile-picture", function (result, status) {
document.getElementById("previewFix").src = "data:image/png;base64," + result;
var base64String = "data:image/png;base64," + result;
var sanitizedBase64String = sanitizeHtml(base64String);

Check failure on line 34 in src/main/resources/lessons/pathtraversal/js/path_traversal.js

View check run for this annotation

Cycode Security / Cycode: SAST

src/main/resources/lessons/pathtraversal/js/path_traversal.js#L34 

Unsanitized user input in dynamic HTML insertion (XSS) found
document.getElementById("previewFix").src = sanitizedBase64String;
Comment thread
cycode-security[bot] marked this conversation as resolved.
});
}

Expand All @@ -36,7 +41,7 @@
var picture = document.getElementById("uploadedFileRemoveUserInput").files[0];
var formData = new FormData();
formData.append("uploadedFileRemoveUserInput", picture);
formData.append("fullName", $("#fullNameRemoveUserInput").val());

Check failure on line 44 in src/main/resources/lessons/pathtraversal/js/path_traversal.js

View check run for this annotation

Cycode Security / Cycode: SAST

src/main/resources/lessons/pathtraversal/js/path_traversal.js#L44 

Unsanitized user input in dynamic HTML insertion (XSS) found
formData.append("email", $("#emailRemoveUserInput").val());
formData.append("password", $("#passwordRemoveUserInput").val());
return formData;
Expand All @@ -44,20 +49,26 @@

webgoat.customjs.profileUploadCallbackRemoveUserInput = function () {
$.get("PathTraversal/profile-picture", function (result, status) {
document.getElementById("previewRemoveUserInput").src = "data:image/png;base64," + result;
var base64String = "data:image/png;base64," + result;
var sanitizedBase64String = sanitizeHtml(base64String);

Check failure on line 53 in src/main/resources/lessons/pathtraversal/js/path_traversal.js

View check run for this annotation

Cycode Security / Cycode: SAST

src/main/resources/lessons/pathtraversal/js/path_traversal.js#L53 

Unsanitized user input in dynamic HTML insertion (XSS) found
document.getElementById("previewRemoveUserInput").src = sanitizedBase64String;
Copy link
Copy Markdown
Author

@cycode-security cycode-security Bot Mar 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

❗Cycode: SAST violation: 'Unsanitized user input in dynamic HTML insertion (XSS)'.

Severity: High

Description

Unsanitized user input in dynamic HTML insertion can lead to Cross-Site Scripting (XSS) attacks. This vulnerability arises when user-provided data is directly inserted into the DOM without proper sanitization, potentially allowing attackers to execute malicious scripts.

Cycode Remediation Guideline

✅ Do

  • Do use an HTML sanitization library to clean user input before inserting it into the HTML. This step helps prevent XSS attacks by removing or neutralizing any potentially harmful scripts.
import sanitizeHtml from 'sanitize-html';

const html = `<strong>${user.Input}</strong>`;
document.body.innerHTML = sanitizeHtml(html);

📋 References

🎥 Learning materials (by Secure Code Warrior)

Tell us how you wish to proceed using one of the following commands:

Tag Short Description
#cycode_sast_ignore_here <reason> Ignore this violation — applies to this violation only
#cycode_ai_remediation Request remediation guidance using Cycode AI
#cycode_sast_false_positive <reason> Mark as false positive — applies to this violation only

⚠️ When commenting on Github, you may need to refresh the page to see the latest updates.

});
}


webgoat.customjs.profileUploadCallbackRetrieval = function () {
$.get("PathTraversal/profile-picture", function (result, status) {
document.getElementById("previewRetrieval").src = "data:image/png;base64," + result;
var base64String = "data:image/png;base64," + result;
var sanitizedBase64String = sanitizeHtml(base64String);
document.getElementById("previewRetrieval").src = sanitizedBase64String;
Copy link
Copy Markdown
Author

@cycode-security cycode-security Bot Mar 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

❗Cycode: SAST violation: 'Unsanitized user input in dynamic HTML insertion (XSS)'.

Severity: High

Description

Unsanitized user input in dynamic HTML insertion can lead to Cross-Site Scripting (XSS) attacks. This vulnerability arises when user-provided data is directly inserted into the DOM without proper sanitization, potentially allowing attackers to execute malicious scripts.

Cycode Remediation Guideline

✅ Do

  • Do use an HTML sanitization library to clean user input before inserting it into the HTML. This step helps prevent XSS attacks by removing or neutralizing any potentially harmful scripts.
import sanitizeHtml from 'sanitize-html';

const html = `<strong>${user.Input}</strong>`;
document.body.innerHTML = sanitizeHtml(html);

📋 References

🎥 Learning materials (by Secure Code Warrior)

Tell us how you wish to proceed using one of the following commands:

Tag Short Description
#cycode_sast_ignore_here <reason> Ignore this violation — applies to this violation only
#cycode_ai_remediation Request remediation guidance using Cycode AI
#cycode_sast_false_positive <reason> Mark as false positive — applies to this violation only

⚠️ When commenting on Github, you may need to refresh the page to see the latest updates.

});
}

function newRandomPicture() {
$.get("PathTraversal/random-picture", function (result, status) {
document.getElementById("randomCatPicture").src = "data:image/png;base64," + result;
var base64String = "data:image/png;base64," + result;
var sanitizedBase64String = sanitizeHtml(base64String);
document.getElementById("randomCatPicture").src = sanitizedBase64String;
Copy link
Copy Markdown
Author

@cycode-security cycode-security Bot Mar 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

❗Cycode: SAST violation: 'Unsanitized user input in dynamic HTML insertion (XSS)'.

Severity: High

Description

Unsanitized user input in dynamic HTML insertion can lead to Cross-Site Scripting (XSS) attacks. This vulnerability arises when user-provided data is directly inserted into the DOM without proper sanitization, potentially allowing attackers to execute malicious scripts.

Cycode Remediation Guideline

✅ Do

  • Do use an HTML sanitization library to clean user input before inserting it into the HTML. This step helps prevent XSS attacks by removing or neutralizing any potentially harmful scripts.
import sanitizeHtml from 'sanitize-html';

const html = `<strong>${user.Input}</strong>`;
document.body.innerHTML = sanitizeHtml(html);

📋 References

🎥 Learning materials (by Secure Code Warrior)

Tell us how you wish to proceed using one of the following commands:

Tag Short Description
#cycode_sast_ignore_here <reason> Ignore this violation — applies to this violation only
#cycode_ai_remediation Request remediation guidance using Cycode AI
#cycode_sast_false_positive <reason> Mark as false positive — applies to this violation only

⚠️ When commenting on Github, you may need to refresh the page to see the latest updates.

});
}

Expand Down