I am trying to sanitize the input source JSON data in the below function. However, the Checkmarx tool still complains no matter where I add the sanitizeObject(). Appreciate any pointers
const fs = require('fs')
const config = require('config')
var _require = require('jsdom'),
JSDOM = _require.JSDOM;
var window = new JSDOM('').window;
var DOMPurify = createDOMPurify(window);
function sanitizeValue(value){
return DOMPurify.sanitize(value);
}
function sanitizeObject(obj) {
var sanitizedObject = {};
Object.keys(obj).forEach(function (key) {
sanitizedObject[key] = sanitizeValue(obj[key]);
});
return sanitizedObject;
};
const getMyData = () => {
let myData = JSON.parse(sanitizeObject(fs.readFileSync('./my/dist/path/mydata.json')))
return myData
}
Checkmarx error: Stored-CSS error as follows
complains at readFileSync
The application's = embeds untrusted data in the generated output with send, at Xx of module.js. This untrusted data is embedded straight into the output without proper sanitization or encoding, enabling an attacker to inject malicious code into the output.
The attacker would be able to alter the returned web page by saving malicious data in a data-store ahead of time. The attacker's modified data is then read from the database by the = method with readFileSync, at line 11 of module.js. This untrusted data then flows through the code straight to the output web page, without sanitization.
This can enable a Stored Cross-Site Scripting (XSS) attack