title: checkmarx reported REFELCTED_XSS_ALL_CLIENT for Volley
body: <p>My project for an Android app uses Checkmarx to scan the source code for security issues. Checkmarx reports an issue with the Google Volley library. Here is the error description:</p>
  
  <blockquote>
    <p>Method performRequest at line 89 of
    \app\libraries\volley\src\main\java\com\android\volley\toolbox\HurlStack.java
    gets user input for the getHeaders element. This element’s value then
    flows through the code without being properly sanitized or validated
    and is eventually displayed to the user in method parseNetworkResponse
    at line 61 of
    \app\libraries\volley\src\main\java\com\android\volley\toolbox\JsonArrayRequest.java.
    This may enable a Cross-Site-Scripting attack.</p>
  </blockquote>
  
  <pre><code>  public HttpResponse performRequest(Request&lt;?&gt; request, Map&lt;String, String&gt; additionalHeaders)
              throws IOException, AuthFailureError {
          String url = request.getUrl();
          HashMap&lt;String, String&gt; map = new HashMap&lt;String, String&gt;();
          map.putAll(request.getHeaders());
          map.putAll(additionalHeaders);
       ....
  }
  </code></pre>
  
  <p>It says the headers of the request are cached and later displayed to the users in the <code>JsonArrayRequest::parseNetworkResponse</code>. However I can not find it is displayed to the user at all. Is this a false alarm? And in what condition a Cross-Site-Scripting attack may occur on an Android app? Does that only happen when you use a webview?</p>