如何防止 Checkmarx 中 location.href 的 CLIENT_DOM_XSS？

Question

I am getting "CLIENT_DOM_XSS" vulnerability while scanning my project with Checkmarx.

Below is the line of code which causing issue:

// make sure we are the top most window
if (window != top)  top.location.href = location.href;

I am getting this vulnerability for location.href.

Can anyone please suggest me for fix?

Thank you.

Answer 1

Most of the Vulnerabilities are coming from the user input, to the potential vulnerable point.

It means that most of the time is better to sanitize the user input to avoid getting malicious input in the code flow. Then you can try to think about use-case.

So you need to sanitize the location.href before you are using it.

Use Case:

You are taking the href into top.href . The top can be an iframe or something, right? (I'm not professional on it).

You don't know always what the iframe doing, but maybe I know, so I'm sending a link to you website with a malicious XSS in the QueryString, so that the iframe will get the XSS.

Maybe you might to say "the iframe will handle this vulnerability, but for my opinion, you don't want malicious code in you app, in any level.