function accessAccount() {
var errorMessage = "";
var checkedResult = true;
$(".errorDisplay").hide();
var accountNumber = document.getElementById('customerAccountNumber').value;
var accountType = document.getElementById('customerAccountType').value;
$("#overlayPopup").show();
$.ajax({
url : '<attribute:resourceURL/>',
data : {
"number" : accountNumber ,
"type" : accountType
},
success : function(response) {
if (response == 'CUSTOMER_ACCOUNT') {
window.location = "/customer/account";
} else {
$("#overlayPopup").hide();
//display warning
$(".errorDisplay").show();
$(".errorDisplay").text(response); // <--- Sanitize this line for XSS
e.preventDefault();
}
},
cache : false,
dataType : 'text',
error : function(error, textStatus, errorThrown) {
alert('Error: ' + textStatus);
console.log('Error: ' + textStatus);
window.location = "/customer/account/lookup";
},
timeout : ajaxTimeOutMilliSeconds
});
}
The Veracode report indicates an issue with $(".errorView").html(data);. How can I address this? Will simply changing it to text prevent client-side rendering of HTML?