I'm using a free template as a front end in my application and the main javascript file came out as a high risk as it's vulnerable to a dom based cross site scripting.Is there a way to sanitize the javascript function inside a javascript file? I searched and i found a .net library "System.Web.Security.AntiXss" that works on the server side but what should i use in this js file? the js file:
// Activate smooth scroll on page load with hash links in the url
$(document).ready(function() {
if (window.location.hash) {
var initial_nav = window.location.hash;
if ($(initial_nav).length) {
var scrollto = $(initial_nav).offset().top - scrolltoOffset;
$('html, body').animate({
scrollTop: scrollto
}, 1500, 'easeInOutExpo');
}
}
});
// Toggle .header-scrolled class to #header when page is scrolled
$(window).scroll(function() {
if ($(this).scrollTop() > 100) {
$('#header').addClass('header-scrolled');
} else {
$('#header').removeClass('header-scrolled');
}
});
if ($(window).scrollTop() > 100) {
$('#header').addClass('header-scrolled');
}
// Back to top button
$(window).scroll(function() {
if ($(this).scrollTop() > 100) {
$('.back-to-top').fadeIn('slow');
} else {
$('.back-to-top').fadeOut('slow');
}
});
$('.back-to-top').click(function() {
$('html, body').animate({
scrollTop: 0
}, 1500, 'easeInOutExpo');
return false;
});
// jQuery counterUp
$('[data-toggle="counter-up"]').counterUp({
delay: 10,
time: 1000
});
// Init AOS
function aos_init() {
AOS.init({
duration: 1000,
easing: "ease-in-out",
once: true,
mirror: false
});
}
$(window).on('load', function() {
aos_init();
});
})(jQuery);
Thank you in advance.
$()
- which is exactly the same asjQuery(location.hash)
. Worst comes to worst you could always just remove this - it's job is to scroll nicely to a div, but the browser will always do that by default, just without a transition.document.getElementById()
. You can even convert that to a jQuery element (I think), so something like this$(document.getElementById(initial_nav)).length
, etc...