js 代码 $(this).attr('name') 的 checkmarx 扫描问题

Question

I wrote the below line of code in my js file

var radio =
DOMPurify.sanitize($($.parseHTML(decodeURIComponent(encodeURIComponent($
(this).attr('name'))))).text());

and the checkmarx scan throws the below error at the above line

"The application embeds untrusted data in the generated output with $, at the above line of com.js. This untrusted data is embedded straight into the output without proper sanitization or encoding, enabling an attacker to inject malicious code into the output."

Can someone please tell me what I am doing wrong and what I need to do in order to fix this vulnerability issue? Thanks in advance

I have implemented DOMPurify.sanitize

Answer 1

I see two conflicting issues in your code.

1. You're encoding (this).attr('name') and then decoding it back (why?)
2. You don't need to use parseHtml since (this).attr('name') is already a DOM object

You can simply write it as:

var radio = DOMPurify.sanitize(($(this).attr('name')).text());