How to avoid Reflected_xss_all_clients vulnerabilities in Winforms c#

Question

Currently, I am working for a Winforms project. When I am scanning my Winforms application through CheckMarx then I am getting multiple Reflected_xss_all_clients vulnerabilities. I know there is no scripting in Winforms. XSS is a web threat but may be there would be some way to remediate these threats during scanning.

Here is the error code section 1:

private void UpdatePreviewValue()
  {
     try
     {
        // Set the preview value
        if (txtFieldValue.Text != string.Empty)
        {
           // Show the preview value
           lblPreview.Text = "(" + txtFieldValue.Text + ")";
        }
        else
        {
           // Show that there is no field value
           lblPreview.Text = Properties.Resources.Std_Txt_Fld_NoFieldValue;
        }
     }
     catch (Exception ex)
     {
        frmErrorHandler.ShowDataError(Properties.ErrorStrings.ErrorTitle_SrcFldCtlInteger_UpdatePreviewValue, DataErrorImageConstants.Exclamation, ex);
     }
  }

in above code section, the line lblPreview.Text = "(" + txtFieldValue.Text + ")";is throwing Reflected_xss_all_clients vulnerabilities.

Here is the error code section 2:

      /// <summary>
      /// Method to copy an existing node for moving inside a grid
      /// </summary>
      /// <param name="rowToCopy">GridRow to copy</param>
      /// <returns>GridRow</returns>
      private GridRow CopyGridRow(GridRow rowToCopy)
      {
         GridRow newRow = gridCategories.NewRow();
         newRow.Tag = rowToCopy.Tag;
         newRow.Cells[0].Text = rowToCopy.Cells[0].Text;
         newRow.Cells[0].Image = rowToCopy.Cells[0].Image;
         newRow.Cells[1].Text = rowToCopy.Cells[1].Text;

         if (rowToCopy.HasRows)
         {
            foreach (GridRow nestedRow in rowToCopy.NestedRows)
            {
               newRow.NestedRows.Add(CopyGridRow(nestedRow));
            }
         }

         return newRow;
      }

in above code section, the line newRow.Cells[0].Text = rowToCopy.Cells[0].Text; and newRow.Cells[1].Text = rowToCopy.Cells[1].Text;are throwing Reflected_xss_all_clientsvulnerabilities.

Here is the error code section 3:

  /// <summary>
  /// Method used to add a new discrete value to the listview
  /// </summary>
  private void AddDiscreteValue()
  {
     // check we have an entry to add
     if (txtDiscreteValue.Text != "")
     {
        SetDiscreteValue(txtDiscreteValue.Text, true, null, false);
     }
  }

In above code section, the line SetDiscreteValue(txtDiscreteValue.Text, true, null, false); is throwing Reflected_xss_all_clients vulnerabilities for txtDiscreteValue.Text

Please suggest any way to remediate it, if possible.

question from:https://stackoverflow.com/questions/65920643/how-to-avoid-reflected-xss-all-clients-vulnerabilities-in-winforms-c-sharp

Answer 1

Checkmarx will follow the string from input to use. Sometimes it identifies a variable which is not fillterd transited to the frontend as a XSS.

As for me, I always ignore the XSS reported from Checkmarx. Maybe you can use a fillter function before use the string variable. Like this

     txtFieldValue.Text=cleanXSS(txtFieldValue.Text) 

As for cleanXSS(), you can find many examples after google.