XSS flaw on BinaryWrite

Question

To open pdf file in browser at client side I am using following server side C# code

context.Response.BinaryWrite(byteArray);

Now the problem is Veracode is giving XSS flaw(CWE ID 80) on this line.

Can anyone help me how to resolve this flaw?

Answer 1

That's an indicator that tainted data is landing in the response stream of the request. This means an attacker could potentially inject data into your Web Site (what we call XSS) or in this specific case your pdf file (different than XSS, but still an injection weakness). I would make sure there isn't a vector for an attacker to inject arbitrary data into your PDF file that could be used to compromise a consumer of that PDF document.