title: VeraCode - This call to name() contains a cross-site scripting (XSS) flaw
body: <p>Could anyone explain why VeraCode appears to think using <code>name</code> as a public property is a bad idea and propose a good comment for mitigation?</p>
  <p>the code (JavaScript):</p>
  <pre><code>var BatchTask = (function () {
      function BatchTask(batchOrTask, isBatch) {    
          if (isBatch) {
              ...
          }
          else {
              var task = batchOrTask;
              this.name = task.name; // flaw identified on this line
          }
      }
      return BatchTask;
  }());
  </code></pre>
  <p>the flaw: <a href="http://cwe.mitre.org/data/definitions/80.html" rel="nofollow noreferrer">CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)</a></p>
  <blockquote>
  <p><strong>Attack Vector</strong>: name</p>
  <p><strong>Description</strong>: This call to name() contains a cross-site scripting (XSS) flaw. The application populates the HTTP response with untrusted
  input, allowing an attacker to embed malicious content, such as
  Javascript code, which will be executed in the context of the victim's
  browser. XSS vulnerabilities are commonly exploited to steal or
  manipulate cookies, modify presentation of content, and compromise
  confidential information, with new attack vectors being discovered on
  a regular basis.</p>
  </blockquote>