1

We have received Security review issues for <aura:html tag="style"> used in Lightning component .cmp file.

This was done to change the modal width which is opened from Quick Action.

<aura:html tag="style">
    .slds-modal__container {
        min-width: 90vw;
    }
</aura:html>

I know how to resolve this though, we can put a custom class and use css child selector and load css in root of the dom using ltng:require. For eg:

    .customComponent.slds-modal__container {
        min-width: 90vw;
    }

But does this pose any security concern, if so, how. And why there is no documentation regarding this.

0

It does not appear that that the html tags where flagged so much as the use of css, which doesn't seem like a valid finding given the information you've presented (e.g no reviewer notes, and no access to the code, or even vulnerability title).

One possible issue to keep in mind is that by mandating 90% of the viewport for your component, you are not being a friendly neighbor in which there are other components written by other vendors on the same page. What if they all have similar css settings? That said, the security review may not be the appropriate place to raise these issues and I'd get this resolved in an office hour.

1
  • One possible issue to keep in mind is that by mandating 90% of the viewport for your component, you are not being a friendly neighbor in which there are other components written by other vendors on the same page. , this is a modal, so it should not matter how many components are there on page as it is only mandating modal size to increase. – Nagendra Singh May 13 at 0:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.