XSS: window.location.href and window.open

Question

I'm working through all issues that the static security analysis tool Fortify found in our internal Angular application. There is one particular issue I'm not confident of how to work with. Please see the following code, which is the event handler of a <select> HTML element:

if (selectedValue === -3) {
    window.open(
        window.location.href.substring(0, window.location.href.indexOf('/ui/')) + '/ui/newEntry',
        '_blank'
    );
}

In case the selected value is -3 (Add new element), a new tab/window will be opened where the user can create a new entry.

The script is executed under https://my.domain.com/hello/world/ui/account/123.

I assume that Fortify marks this code as prone to XSS attacks because of constructing the destination URL from the current URL, which might be evil.

Now I'd like to learn how to solve this potential problem. Can I somehow safely construct the URL to open?

Answer 1

I think the XSS flag is coming from the fact that window.location.href could be overwritten and include a javascript-URI for instance.

If you want to keep using window.location.href in the construction of a new URL, you could add extra validation for the current value (e.g., does it start with exactly https://example.com/ui/. I would not be surprised if the flag remained, however, for as long as you construct the URL this way.

Safer alternatives would just using a fixed relative path (e.g. window.open('/ui/newEntry', '_blank')).

Answer 2

We can get the URL and also set the URL using window.location.href. But the problem of setting the URL is it is prone to attack.

So instead of using window.location.href for building your URL to the next page you can use a readonly property of location which is origin(window.location.origin).

Here is a link to the MDN documentation.

This is easiest way I could think of.