如何通过 JQuery 修复 CWE 117（不正确的 Output 中和日志）

Question

The scan throw this error about this line:

console.log(msg);

I need this line on my code, but I want to change to more secure. I added this to my code:

var newMsg = msg.replace('\n', '_').replace('\r', '_');

Then I sent the newMsg to the log. I saw it isn't enough, I read that sometimes should to encoded the message. When should I encode it, and how can I do it in javascript/jQuery?

Thanks

Answer 1

To get rid of CWE 117 (raw value log printing on production enviroments) you should go through mitigation steps on MITRE's specification , this is:

code(before log printing) should:

• Disallow content (business logic specific)

• Escape HTML content:

   In: `<p>Hello <script>this_is_bad_code</script> world:</p>` Out; `&lt;p&gt;Hello &lt;script&gt;this_is_bad_code&lt;/script&gt; world;&lt;/p&gt;`

• Strip content:

   In: <p>Hello <script>this_is_bad_code</script> world:</p> Out: Hello world!

• Clean content to get safe html (business logic specific):

   In: <p>Hello <script>this_is_bad_code</script> world:</p> Out: <p>Hello world!</p>

: This is a shabby one in js, as a js source file can have any kind of encoding, JavaScript will convert it to UTF-16 before executing it, still you can:

• Check if current page encoding tag value is up in header:

   Content-Type: application/javascript; charset=utf-8

• Check if source js encoding tag value is up:

   <script src="./source.js" charset="utf-8">