Impact Area
Security
Severity
High
Affected Element
ServiceNow
UI Script
Salesforce
Static Resource
Rule number
SN-JSL-006 (for ServiceNow)
SF-JSL-009 (for Salesforce)
Impact #
Cross-site scripting (XSS) vulnerability in jQuery before 1.8.0. The regex-based input HTML replacement may turn sanitized code into unsanitized one. Wrapping “<option>” elements in “<select>” ones changes parsing behavior, leading to possibly unsanitizing code.
Remediation #
Update AngularJS to the latest version.
Time to fix #
30 min
References #
This rule is linked to Common Weakness Enumeration CWE-79 Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’).
