使用 javascript 加载部分视图：HP FORTIFY 可能的 XSS

Question

I have a js function , which Fortify identified as XSS vulnerable as below. Can you suggest any solution for this since the method is intensively used in my app.

I am here trying to call a partialview in ajax and the result html am appending to a specified dom div

My function look like the below

      function loadPartialViewToDiv(div, obj, api) {
        try {
                
    

const myUrl = new URL(window.location.origin +  api); // always local URL only 
    
    $.ajax({       
    
    url: myUrl ,
    data: obj,
    cache: false,
    type: "POST",
    dataType: "html",
    
    success: function (data, textStatus, XMLHttpRequest) {        
    
    if (data != undefined && data != null) {        
    
    $('#' + div).html(data);        
    
    }    
    
    
    }
    
    
    });
    
    
    } catch (e) {
    
    
    ('#' + div).html('Error');
    
    
    }
    
    }

Answer 1

The dynamic DOM element id was the issue ($('#' + div).html(data); ), we fixed it using two methods

1. giving a static id. $('#abcd').html(data);
   OR
2. change as $('#' + div).text($(data));