AngularJS - XSS vulnerability using AngularJS under 1.6.5 in Firefox and Safari - sanitize on inert Documents

Rule number

SN-JSL-006 (for ServiceNow)

SF-JSL-008 (for Salesforce)

Impact

Both Firefox and Safari are vulnerable to XSS injection if the $sanitize function uses an inert document created via "document.implementation.createHTMLDocument()".

Remediation

Update AngularJS to the latest version.

Time to fix

30 min

References

This rule is linked to Common Weakness Enumeration CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').