Hi,

In our SPA app, we use JS to request a file to download from server. When the file content is returned as response, it will simulate a click event on an invisible download link to start the downloading process. The code kinda looks like this:

var a = document.createElement("a");

a.href = downloadUrl;

a.download = filename;

a.text = "Download";

a.className = "sr-only";

document.body.appendChild(a);

a.click();

Unfortunately, Veracode reports XSS vulnerability on the line where it reads 'document.body.appendChild(a);'. I do realize that appendChild can have XSS vulnerability, but what would be the best way to address this so the issue is fixed and Veracode scan comes back clean? Or is it something we do not need to worry about at all? Thanks.