I'm working through all issues that the static security analysis tool Fortify found in our internal Angular application. There is one particular issue I'm not confident of how to work with. Please see the following code, which is the event handler of a <select>
HTML element:
if (selectedValue === -3) {
window.open(
window.location.href.substring(0, window.location.href.indexOf('/ui/')) + '/ui/newEntry',
'_blank'
);
}
In case the selected value is -3
(Add new element), a new tab/window will be opened where the user can create a new entry.
The script is executed under https://my.domain.com/hello/world/ui/account/123.
I assume that Fortify marks this code as prone to XSS attacks because of constructing the destination URL from the current URL, which might be evil.
Now I'd like to learn how to solve this potential problem. Can I somehow safely construct the URL to open?