Checkmarx and angular2 template xss warning

Question

I'm facing the follow warning at checkmarx report. I tried to use sanitized pipe to fix but still returning the warning. Any suggestions?

@AakashGarg {{dataType of displayTypes}} => displayTypes is string[] — André de Mattos Ferraz, May 31 '21 at 13:41
Have you tried injecting the sanitiser into your component and using a getter or method to retrieve your html? — Ben Brookes, Jun 01 '21 at 15:00
Are you sure? If the variables from your template was sanitised HTML then checkmarx wouldn't pick this issue up as the sanitiseHTML pipe wouldn't need to be used. — Ben Brookes, Jun 10 '21 at 11:45
@BenBrookes https://imgur.com/Viy0KVi same error in same case — André de Mattos Ferraz, Jun 10 '21 at 14:44
Does this still occur if you bind the value to `[innerHtml]` ? — Ben Brookes, Jun 10 '21 at 15:41
Let me try. But only the variable or with sanitize method? I will try both... — André de Mattos Ferraz, Jun 10 '21 at 18:10

score 0 · Answer 1 · answered Jun 14 '21 at 17:04

0

I add it to False positive! I will use [innerHTML] attribute from angular to show the values.

answered Jun 14 '21 at 17:04

1 Answers1