ychen466888 (Community Member) asked a question.
Hi team, as i try to download browser in memory data to file use a hiden dom_a, but it had been considered have flaw.
i already tried to encode the filename, set an type for the element, and as it just for download but not for render a html page, is it a false positive flaw, or please help me how to fix it .
this a my code:
saveBlob(blob, filename){
var svgUrl = URL.createObjectURL(blob);
var dom_a = document.createElement("a");
dom_a.download = ESAPI.encoder().encodeForJavaScript(ESAPI.encoder().encodeForHTML(ESAPI.encoder().encodeForURL(filename)));
dom_a.href = svgUrl;
dom_a.style.display = "none";
dom_a.type = blob.type;
document.body.appendChild(dom_a); //as invalid for CWE 80
dom_a.click();
document.body.removeChild(dom_a);
}
.png){kind=logo}
Hi @ychen466888 (Community Member),
I think you may have gone a little overboard with the encoding there r.e. dom_a.download. I would just pass it through a URL encoder myself as it is supposed to be a filename afterall, or consider hard-codeding the file if it is of a known type e.g. "report.pdf".
This is a common pattern for downloading files and so long as your are HTML-encoding (or URL-encoding) the filename this would be ok to mitigate using a Mitigate By Design argument to describe the exact nature of the encoding control in use at this location.
Thanks,
Anthony Fielding
@Anthony Fielding thank you for your support,
i understood that is a common pattern for file download and will mark it as a Mitigate By Design .