基于DOM的XSS在哪里

Question

I received an AppScan security report where the following piece of code was flagged as "DOM Based Cross-Site Scripting":

i !== null && i.errors ? (i.errors[0].Key === "OrderNotFound" || 
i.errors[0].Key === "ShoppingCartModified") && (alert(i.errors[0].Value),
window.location.href = window.location.href.split("#")[0]) : 
t([s("GenericErrorMessage")])

But I can't see where the problem is. I wonder if this could be a false positive. This is the original code without minification

if (jsonResult !== null && jsonResult.errors) {
    if (jsonResult.errors[0].Key === "OrderNotFound" ||
        jsonResult.errors[0].Key === "ShoppingCartModified") {
        alert(jsonResult.errors[0].Value); //the problem is here
        window.location.href = window.location.href.split("#")[0]; //or here
    }
} else {
    //uiErrors is a KnockoutJS observableArray that is 
    //shown in the page using the text binding avoiding any innerHTML injection.
    //res = method that returns an error msg string for a given key.
    uiErrors([res("GenericErrorMessage")]); 
}

jsonResult is the response of an ajax call and it has the following structure:

{
    "errors": [
        {"Key": "OrderNotFound", "Value": "Your order could not be found."}
    ]
}

Where both the Key and Value are not created using any user input. They are const strings in server code.

Adding AppScan Output

[1 of 1] DOM Based Cross-Site Scripting

Severity: High

Test Type: Application

Vulnerable URL: https://www.domain.com/scripts/checkout.js

CVE ID(s): N/A

CWE ID(s): 79

Remediation Tasks: Analyze client side code and sanitize its input sources

Variant 1 of 1 [ID=1612185601]

Request/Response:

https://www.domain.com/scripts/checkout.js ? v=m9is46e_hmcr4gnmuj4o6xssdozcytmn9flbuxtvbmy1:

1 : i !== null && i.errors ? (i.errors[0].Key === "OrderNotFound" || i.errors[0].Key === "ShoppingCartModified") && (alert(i.errors[0].Value), window.location.href = window.location.href.split("#")[0]) : t([s ("GenericErrorMessage")])

Validation In Response:

N/A

Reasoning:

N/A

CWE ID:

79

Answer 1

The code you have shown does not appear to have any XSS problem. Either this is a false positive, or the scanner has not properly identified the location of the problem.

It might be worth re-running the scanner on your application while using completely unminified code so as to get more precise location information; even if it is actually a false positive this would help you understand what the scanner is confused about.

Answer 2

window.location.href = window.location.href.split("#")[0];

the above line of code causing you the issue. technicallyn split("#")[0] will remove values after # character.. but he cache point here is: what if we include injection before "#" character ?

protocal://domainname.com/details.htm/ "injection!@#$XSS" #Helloworld!