<p dir="auto">Veracode is reporting that all versions of axios (up to and including 0.19.0-beta.1) contain a XSS vulnerability. (CVSSv3: 6.1)</p>
<p dir="auto">Very limited details available:<br>
<a href="https://www.sourceclear.com/vulnerability-database/security/sca/vulnerability/sid-21679/summary" rel="nofollow">https://www.sourceclear.com/vulnerability-database/security/sca/vulnerability/sid-21679/summary</a></p>
<p dir="auto">I suspect it is a false positive based on comments <a href="https://github.com/axios/axios/issues/2447" data-hovercard-type="issue" data-hovercard-url="/axios/axios/issues/2447/hovercard">here</a>. Would value any thoughts / input</p>
<p dir="auto">Thanks</p>
<p dir="auto"><strong>Describe the bug</strong><br>
A Fortify Scan finds a critical Cross-Site Scripting vulnerability in Axios here:</p>
<p dir="auto"><a href="https://github.com/axios/axios/blob/master/lib/helpers/isURLSameOrigin.js#L30">https://github.com/axios/axios/blob/master/lib/helpers/isURLSameOrigin.js#L30</a></p>
<div class="highlight highlight-source-js notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="urlParsingNode.setAttribute('href', href);"><pre class="notranslate"><span class="pl-s1">urlParsingNode</span><span class="pl-kos">.</span><span class="pl-en">setAttribute</span><span class="pl-kos">(</span><span class="pl-s">'href'</span><span class="pl-kos">,</span> <span class="pl-s1">href</span><span class="pl-kos">)</span><span class="pl-kos">;</span></pre></div>
<blockquote>
<p dir="auto">The method resolveURL() sends unvalidated data to a web browser, which can result in the browser executing malicious code.</p>
</blockquote>
<p dir="auto">This issue has been <a href="https://github.com/axios/axios/issues/2165" data-hovercard-type="issue" data-hovercard-url="/axios/axios/issues/2165/hovercard">reported previously</a>, but then it was closed as 0.19.0 was supposed to provide a fix.</p>
<p dir="auto">We ran a Fortify scan on 0.19.0 and got the same error; the source code still contains the problematic line above and the issue remains.</p>