search

ocombe / ocLazyLoad

Lazy load modules & components in AngularJS
https://oclazyload.readme.io
MIT License
2.63k stars 510 forks source link

High Security issue XSS on ocLazyLoad 0.5.2 at 235 line #438

Open bonaerges opened 4 years ago

bonaerges commented 4 years ago

We have scan code by veracode using oclazyload.js version 0.5.2 and a High security issue has been found "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (CWE ID 80) at oclazyload.jss 235 line"

angular.forEach(angular.element(data), function(node) { if(node.nodeName === 'SCRIPT' && node.type === 'text/ng-template') { $templateCache.put(node.id, node.innerHTML); }

We use angular 1.6.9 and oclazyload.js v 0.5.2

image

We need to know how to solve in less than 60 days.PLease advice.

Thanks in advance.

KHANRAA commented 3 years ago

+1