Skip to content

CWE-829: Inclusion of Functionality from Untrusted Source

Overview

This guidance helps you interpret and remediate findings from DAST (Dynamic Application Security Testing) tools. The scanner detected that the application loads resources (scripts, stylesheets, libraries) from untrusted or user-controlled sources. Evidence includes successful injection of external JavaScript via parameters controlling <script src> attributes, acceptance of arbitrary CDN URLs, or dynamic loading of code from attacker-controlled domains. Responses show external resource inclusion based on user input.

Analyzing the Dynamic Scan Result

What the DAST Scanner Found

DAST findings for CWE-829 typically indicate that external functionality was loaded or executed at runtime without sufficient trust guarantees, such as:

  • Scripts or libraries loaded from external domains
  • Dependencies fetched without integrity verification
  • Runtime inclusion of remote code
  • Use of third-party resources without provenance controls

Evidence is based on observed runtime inclusion behavior, not on request parameters or payload syntax.

Mapping DAST Findings to Source Code

CWE-829 does not map to a single endpoint or parameter. The issue resides in how the application sources, verifies, and executes external functionality.

When tracing this issue in code and build configuration, review:

  • How external scripts or libraries are selected
  • Dependency management and update mechanisms
  • Integrity verification (hashes, signatures)
  • Runtime loading of remote code
  • Centralized vs ad hoc inclusion of third-party functionality

Remediation

Core Principle: Never execute or load functionality from sources whose integrity and provenance are not explicitly verified; all executable code must originate from a trusted, controlled source.

→ For comprehensive remediation guidance, see Static CWE-829 Guidance

Verification and Follow-Up Testing

After applying the fix:

1. Verify Source Trust

  • Confirm all executable code originates from approved sources
  • Ensure integrity verification is enforced for third-party functionality

2. Test Edge Cases

  • Dependency updates and rollbacks
  • Runtime loading paths
  • Fallback or legacy inclusion mechanisms

Re-run DAST Scanner

Re-run the dynamic scanner to confirm untrusted functionality inclusion is no longer observed.

Additional Resources