白源扫描报告和AngularJS 1.4.7

Question

I am getting the following Vulnerability issue:

Angular-1.4.7.min.js
No proper sanitize of xlink:href attribute interoplation, thus vulnerable to Cross-site Scripting (XSS).

 WS-2017-0120 2017-01-20
 angular-1.4.7.min.js Latest Stable Version: 1.7.5 
No proper sanitize of xlink:href attribute interoplation, thus vulnerable to Cross-site Scripting (XSS).
Replace or update the following files: compileSpec.js, compile.js 

Details:

Link Can someone please tell me what exactly do I need to do with the provided link?

Answer 1

根据您链接到的提交的建议，将AngularJS升级到1.50-beta.1版本或修复有问题的行。

Answer 2

Most javascript-client frameworks "XSS" vulnerabilities are just XSS defense bypass vulnerabilities, and requires an additional initial entry point (giving the user an explicit ability to modify an attribute\\property) or XSS in order to actually exploit it. This seems like another one of these cases similar to this one: Is Bootstrap 3.3.7 safe and secured if "data-target" attribute is unused?