CODEWITHSUNDEEP
javascriptxsscheckmarxsecure-codingclickjacking
W. Young
W. Young

Reputation: 40

Implementing Checkmarx suggested clickjacking fix introduces high severity Client DOM XSS vulnerability

My organization has scanned our code using Checkmarx and the low severity issue Potential Clickjacking on Legacy Browsers was detected due to a JavaScript function firing on an HTML image click event.

We have implemented the following suggested fixes:

<html>
    <head>
        <style> html {display : none; } </style>
        <script>
            if ( self === top ) {
                document.documentElement.style.display = 'block';
            }
            else {
                top.location = self.location;
            }
        </script>
    </head>
    <body>
        <button onclick="clicked();">Click here if you love ducks</button>
    </body>
</html>

Now Checkmarx flags the file for the high severity issue Client DOM XSS due to the line:

top.location = self.location;

that was recommended to be added for legacy click jack protection.

So if we implement the Checkmarx suggested fix on a low severity issue (Potential Clickjacking on Legacy Browsers), we introduce a high severity issue (Client DOM XSS).

What's the proper course of action here?

Upvotes: 1

Views: 9163

Answers (1)

securecodeninja
securecodeninja

Reputation: 2515

To reduce the risk of a DOM-based cross-site scripting vulnerability in your web application, URL encode the self.location

top.location = encodeURI(self.location);

Upvotes: 1

Related Questions