# PYTHON-LAMBDA-SEC-020: Lambda XSS via Tainted HTML Response Body
> **Severity:** HIGH | **CWE:** CWE-79 | **OWASP:** A03:2021
- **Language:** Python
- **Category:** AWS Lambda
- **URL:** https://codepathfinder.dev/registry/python/aws_lambda/PYTHON-LAMBDA-SEC-020
- **Detection:** `pathfinder scan --ruleset python/PYTHON-LAMBDA-SEC-020 --project .`
## Description
This rule detects Cross-Site Scripting (XSS) vulnerabilities in AWS Lambda functions
where untrusted event data is embedded directly in the HTML response body returned to
API Gateway without HTML-escaping.
Lambda functions acting as API Gateway backends frequently generate HTML responses
dynamically. When the response body (the 'body' key in the Lambda return value) is
set to Content-Type: text/html and contains unescaped event data, the browser renders
any injected HTML or JavaScript. Event sources include event.get("queryStringParameters"),
event.get("body"), event["pathParameters"], and event["headers"], all of which are
attacker-controllable through API Gateway requests.
Unlike web frameworks that escape template variables by default, Lambda handlers
that construct HTML strings manually have no automatic escaping layer. The developer
must explicitly call html.escape() on every piece of event data embedded in an HTML
response. Failure to do so enables reflected XSS, where an attacker crafts a URL
or form that causes the Lambda to reflect malicious script back to the victim's
browser.
## Vulnerable Code
```python
import json
import pickle
# SEC-020: tainted HTML response
def handler_html_response(event, context):
name = event.get('name')
body = f"Hello {name}"
return {
"statusCode": 200,
"body": json.dumps({"html": body}),
"headers": {"Content-Type": "text/html"}
}
```
## Secure Code
```python
import html
import json
def lambda_handler(event, context):
params = event.get('queryStringParameters', {}) or {}
name = params.get('name', 'World')
message = params.get('message', '')
# SECURE: Escape all event data with html.escape() before embedding in HTML
safe_name = html.escape(name)
safe_message = html.escape(message)
body = f'''
Greeting
Hello, {safe_name}!
{safe_message}
'''
return {
'statusCode': 200,
'headers': {
'Content-Type': 'text/html; charset=utf-8',
'X-Content-Type-Options': 'nosniff',
'X-XSS-Protection': '1; mode=block',
'Content-Security-Policy': "default-src 'self'"
},
'body': body
}
```
## Detection Rule (Python SDK)
```python
from rules.python_decorators import python_rule
from codepathfinder import calls, flows, QueryType
from codepathfinder.presets import PropagationPresets
_LAMBDA_SOURCES = [
calls("event.get"),
calls("event.items"),
calls("event.values"),
calls("*.get"),
]
@python_rule(
id="PYTHON-LAMBDA-SEC-020",
name="Lambda Tainted HTML Response",
severity="MEDIUM",
category="aws_lambda",
cwe="CWE-79",
tags="python,aws,lambda,xss,html,OWASP-A03,CWE-79",
message="Lambda event data in HTML response body. Sanitize output with html.escape().",
owasp="A03:2021",
)
def detect_lambda_html_response():
"""Detects Lambda event data in HTML response returned to API Gateway."""
return flows(
from_sources=_LAMBDA_SOURCES,
to_sinks=[
calls("json.dumps"),
],
sanitized_by=[
calls("html.escape"),
calls("escape"),
calls("markupsafe.escape"),
],
propagates_through=PropagationPresets.standard(),
scope="global",
)
```
## How to Fix
- Call html.escape() on every piece of Lambda event data before embedding it in an HTML response body.
- Add a Content-Security-Policy header to API Gateway responses to limit the impact of any XSS that bypasses output escaping.
- Set X-Content-Type-Options: nosniff to prevent MIME type sniffing that could enable XSS via non-HTML responses.
- Return JSON responses instead of HTML wherever possible; if the client needs HTML, render it client-side with a trusted JavaScript framework that escapes content automatically.
- Validate and restrict the format of event fields that appear in HTML responses to further reduce the injection surface.
## Security Implications
- **Reflected XSS via API Gateway:** An attacker who controls any query parameter, path parameter, or request body
field can inject