B10066123123 (Community Member) asked a question.
CWE ID: 80 Usage of target="_blank"
Our Angular app displays internally produced html with target="_blank". This html being displayed is internally produced, not something users enter.
As of 2021 major browsers automatically set noopener. Adding noreferrer explicitly, which implies noopener, was still being flagged as well.
Here is the code where sanitizer is the Angular sanitizer:
const cleanString = DOMPurify.sanitize(dirty, { ADD-ATTR: ['target'] });
return this.sanitizer.bypassSecurityTrustHtml(cleanString);
.png){kind=logo}
Hello @B10066123123 (Community Member),
Veracode Static Analysis report report a flaw on any use of bypassSecurityTrustHtml where the data passed to it is marked as "untrusted". For some languages, Veracode Static Analysis supports the use of "cleanser" functions that can be used to safely encode data and mark it as trusted. However, there are no such functions for JavaScript, and as such your "cleanString" variable will still be marked as tainted.
I recommend entering a mitigation that describes to your security team the controls that are in place and how they sufficiently reduce the risk.
Kind regards,
Duncan