After execution of checkmarx report we are facing injection issue for one of our aura lightning component
Issue reported :
The application's <aura:component implements="force:appHostable,flexipage:availableForAllPageTypes,lightning:isUrlAddressable" access="global" > embeds untrusted data in the generated output with url, at line 1. This untrusted data is embedded straight into the output without proper sanitization or encoding, enabling an attacker to inject malicious code into the output.
Issue reported at line number 3 of below code
Code:
<aura:component implements="force:appHostable,flexipage:availableForAllPageTypes,lightning:isUrlAddressable" access="global" >
<aura:attribute name="testDummyurl" type="String" />
<iframe scrolling="no" style="position:absolute;top:0px;width:100%;height:100vh;" src="{!v.testDummyurl}" />
</aura:component>
Please help me and let me know how we can overcome this injection issue reported by checkmarx