We recently can AppScan Source on our product and a number of issues have been identified as exposures.
they seem to be false positives based on teh context of usage, AppScan Source seems to be flagging text.
I need guidance if there are any alternatives to perform the tasks in jQuery.
1. CWE 288 JQuery Calls to Ajax Endpoints Can Be Made Out of Sequence
source line flagged $.ajax(( type" "POST", contentType:"application/x-www-form-urlencoded: charset=utf-8", url:+/IPreports/...."
2. CWE 311 Insecure HTTP Communication
this is from JS Package DataTables-1.10.20
How should all the issues related to DataTable-1.10.20 in general.
3. CWE 79 - JQuery HTML Function Use
).html("* Number of days must be .... ")
NOTE: This is from JavaScript method that is validating client inputs and update a tag to inform user of error
4. CWE 79 - Insecure Use of InnerHTML or OuterHTML
).InnerHTML == "[+]"
NOTE: it is used to toggle the expand / collapse toggle switch.
CWE 79 - JQuery Insecure Manipulation of Child Node
).append(value.clientClientNmae)
NOTE: this is used to dynamically build the drop down based on an Ajax response to restrict use access to unauthorized clients
CVE 79 - Insecure Use of Form Action
This is in DataTables-1.10.20
.action=b;
CVE 79 - Insecure Use of Document Location
This is in DataTables-1.10.20
.location.href= ...
CVE 79 - Potential Issue With Included Script
/IPportal/js/ebonding/juery-3.4.1.min.js
/IPportal/js/jscalendar/calendar.js
CVE 331 - Insecure random number
This is in DataTables-1.10.20
Math.random()