AngularJS - XSS vulnerability under 1.8.0 - input HTML

Rule number

SN-JSL-006 (for ServiceNow)

SF-JSL-009 (for Salesforce)

Impact

Cross-site scripting (XSS) vulnerability in jQuery before 1.8.0. The regex-based input HTML replacement may turn sanitized code into unsanitized one. Wrapping "<option>" elements in "<select>" ones changes parsing behavior, leading to possibly unsanitizing code.

Remediation

Update AngularJS to the latest version.

Time to fix

30 min

References

This rule is linked to Common Weakness Enumeration CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').