如何防止Java客户端DOM代码注入漏洞？

Question

Method function at line xxx of .../addAnnouncements.js gets a client-side controlled data for the json element. This element's value is used in client-side code without being properly sanitized or validated and is eventually integrated into the HTML code in function at linse yyy and zzz of .../addAnnouncements.js.

Script as follows:

 function addAnnouncement() {
        try {
                var formData = $('form').serialize();
                $('div.block').block();
                jQuery.ajax({
                    type: "POST", 
                    url: "bat.ajax", 
                    data: formData,
                    dataType: 'json',
                    cache: false,
  xxx:                  success: function(json) {
  yyy:                      if(json.ERROR == '') {
                            alert("The announcement has been saved");
                            $('div.block').unblock();
                        } else {
  zzz:                          alert(json.ERROR);
                            $('div.block').unblock();
                        }
                    }, 
                    error: function() {
                        $('div.block').unblock();
                        alert('The request could not be fulfilled due an internal error, please try again.'); 
                    }
                });

        } catch(e) {}
    }

The following lines may enable a DOM code injection attack .......

if(json.ERROR =='') {

and

 alert(json.ERROR);

Could some help me how to sanitize the above scenario to satisfy Checkmarx?

Answer 1

Please refer below code It should be help full-

JSON is in string format so we can't access by dot(.)

JSON.parse() is used for JSON to Object conversion. Now we can access by using dot(.).

function addAnnouncement() {

        try {
                var formData = $('form').serialize();
                $('div.block').block();
                jQuery.ajax({
                    type: "POST", 
                    url: "bat.ajax", 
                    data: formData,
                    dataType: 'json',
                    cache: false,
  xxx:                  success: function(json) {
                            var json = JSON.parse(json);
  yyy:                      if(json.ERROR == '') {
                            alert("The announcement has been saved");
                            $('div.block').unblock();
                        } else {
  zzz:                          alert(json.ERROR);
                            $('div.block').unblock();
                        }
                    }, 
                    error: function() {
                        $('div.block').unblock();
                        alert('The request could not be fulfilled due an internal error, please try again.'); 
                    }
                });

        } catch(e) {}
    }