使用 angular 中的 index.html 加强扫描问题

Question

My application is using angular front end with aspnet core and fortify scan brought up security issue on index.html. One issue is this line.

document.write('base href="'=+ document.location+'"/>');

My understanding is this being a single page application, serves us the base container on which other components, scripts are loaded. So how do I address the issue? Isn't this how an angular SPA supposed to be? Secondly, the scan also show multiple lines as vulnerabilities. Those would be and then similarly main.gh9787998886.bundle.js etc.

How can I fix this? Are these false positives?

Answer 1

Fortify often shows false positives (I think to be sure to not forget anything). For example if there is some javascript code like key = 'something' then fortify claims about that with a message like 'hardcoded encryption key'. I had that several times in the bundles where third party components like Kendo UI do things like that. In Fortify you can mark them in the developer status to 'third party component' and let them disappear as suppressed issues. Fortify remembers that for the next code check, so you just have to do that once.

document.write('base href="'=+ document.location+'"/>');

I think this is not a false positive. I would recommend to replace that by

  <base href=".">

For the case you use that to cover different deployments you should better use the --baseHref option for the build command.