GSA / smartpay-training

Prototype for new GSA SmartPay training quizzes
8 stars 4 forks source link

Static Code Vulnerability: js/incomplete-URL-substring-sanitization #698

Open JennaySDavis opened 1 week ago

JennaySDavis commented 1 week ago

Rule Name: js/incomplete-URL-substring-sanitization Rule Description: gsa.gov' may be preceded by an arbitrary hostname. Level: High Location: (URI) training-front-end/src/plugins/uswds_links.js Comments: Allowing all preceding hosts is intentional. This code labels a link as external if it is not on this site's domain or a subdomain.