I'm spending time trying to fix veracode scan flaw CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS).

What I do is an HTTP call to my backend in order to open a blob with a download file.'

downloadFile : function(returndata) {         
    const a = document.createElement("a");
    a.style.display = "none";
    a.href = returndata;

because of this line document.body.appendChild(a); I am getting error in Veracode is there a way to resolve this issue ?

  • DOM based XSS Prevention
    – glls
    Commented Sep 3, 2021 at 15:02
  • The solution is to not attach the link to the DOM at all. See the source in the linked question. If this doesn't answer your question, please let me know, and I'll be happy to reopen your question for you.
    – sfdcfox
    Commented Sep 3, 2021 at 15:21
  • @Sfdcfox---I tried what was mentioned in the link but still the issue is not resolved throws the same error Commented Sep 7, 2021 at 21:19


Browse other questions tagged .