In an application security environment, I use Fortify Software's Fortify360 on a daily basis.
One of my biggest hurdles is explaining the numbers (sources vs sinks)
Fortify flags each location in the source code where unvalidated data is displayed to a user as a Cross-Site Scripting vulnerability.
Let's assume there are 300 locations (sinks) where unvalidated data is displayed to the user. Of those 300 sinks, the data is ALL pulled from a database utilizing one function. (source)
Fortify will subsequently report that there are 300 Cross-Site Scripting vulnerabilities. What it doesn't explicitly tell you is that 300 of which may potentially be fixed from the same location.
My question to you, from an Application Security Engineer point of view, do you then report to your client that there are 300 Cross-Site Scripting vulnerabilities, or 1 Cross-Site Scripting vulnerability? Are either of those statements accurate?
Do you report the source, or the sink?
What I am currently doing is reporting that there are 300 POTENTIAL Cross-Site Scripting vulnerabilities which may all be fixed within one function/method.
Is it more accurate to say that there is 1 Cross-Site Scripting vulnerability which is exposed in 300 locations?
I realize some of this is subjective, but I'm looking for input from others in the field who can shed some light on their methods.