YSahli187971 (Community Member) asked a question.
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Angular
private _downloadDocument(blobUrl, docName) {
var a = document.createElement('a');
a.href = this.sanitizer.sanitize(SecurityContext.RESOURCE_URL, this.sanitizer.bypassSecurityTrustResourceUrl(blobUrl));
a.target = '_blank';
a.download = this.sanitizer.sanitize(SecurityContext.RESOURCE_URL, this.sanitizer.bypassSecurityTrustResourceUrl(docName));;
document.body.appendChild(a);
}
in this example I try to sanitize input (blobUrl, docName)
But in veracode scan this is highlighted how can I fix this in typescript for angular.
.png){kind=logo}
As far as I know, for the Veracode Static Scanner, there are currently no recognized sanitizers for JavaScript/TypeScript. As such, you will need to review each flaw it identifies (like this one), and convince yourself (or your security person) that you are properly protecting from XSS injections, and then mark the item as "Mitigated by Design" and include your justification in your mitigation (not that these justifications are included in your reports, so it's a good idea to write them for reading by "the public" (or whomever you might share the reports with, like customers)).
BTW, what sanitizer are you using? (I'm interested as we are looking at new options for our code for sanitizers)
Hi Robert, I am using standard Angular - Security mechanism.
For more details you can consult the documentation
https://angular.io/guide/security#preventing-cross-site-scripting-xss