VNX-838: Inappropriate Encoding for Output Context

Detects values encoded for the wrong output context: URL encoding (encodeURIComponent, urllib.parse.quote) used for HTML, and quote-less HTML escaping (html.escape(quote=False), cgi.escape) used inside an attribute value. JavaScript/TypeScript and Python.

Field	Value
Rule ID	`VNX-838`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	JavaScript / TypeScript, Python
CWE	CWE-838
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:A/AL:A/IC:N/FC:LT/RP:N/RL:A/AV:I/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`inappropriate-encoding-for-output-context` `xss` `output-encoding` `cwe-838`
Source	`internal/sast/rules/vnx-838.rego`

Overview

VNX-838 maps to CWE-838: Inappropriate Encoding for Output Context. Encoding is only a defence in the context it was designed for. URL encoding is not HTML encoding: encodeURIComponent leaves ' untouched, and the global escape() and urllib.parse.quote were never meant for markup. HTML escaping without quote escaping is safe in element text but not inside an attribute value, where one " closes the attribute.

The rule reports:

JavaScript/TypeScript: encodeURIComponent, encodeURI or the global escape on a line that writes HTML (innerHTML/outerHTML assignment, insertAdjacentHTML, document.write, jQuery .html(), dangerouslySetInnerHTML), unless the value goes into a URL attribute of the tag being built.
Python: urllib.parse.quote/quote_plus inside HTML markup (a string with a tag, Markup(), mark_safe()), unless in a URL attribute; and html.escape(..., quote=False) or cgi.escape() inside an attribute value.

What Gets Flagged

results.innerHTML = '<h2>Results for ' + encodeURIComponent(q) + '</h2>';   // FLAGGED

return f'<input name="{name}" value="{html.escape(value, quote=False)}">'   # FLAGGED
return Markup("<p>Hello " + quote(name) + "</p>")                            # FLAGGED

What Is Not Flagged

URL encoding of a value placed in href, src, action and other URL attributes, or used for a URL or textContent.
HTML escapers (escapeHtml, _.escape, html.escape(value) with quotes), and html.escape(text, quote=False) in element text.
The pattern in comments or string literals, and minified bundles.

Remediation

Encode for the context the value is written into: set textContent (or use the framework’s autoescaping) for text, HTML-escape including quotes for attribute values, and URL-encode only the parts of a URL.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-838
// nosec vnx-838

Or record an ignore rule: vulnetix ignore add --rule vnx-838 --reason "...". See Suppressing findings.