Javascript vulnerability detection

Clean Code Report False-positive / False-negative...
, ,
1

the below code added in the source is not detected as a vulnerability.

const rootEl = document.getElementById('root');
const queryParams = new URLSearchParams(document.location.search);
const input = queryParams.get("input");
rootEl.innerHTML = input;

used default sonarway builtin quality profile.

5

Hello Praveen!

Thank you very much for your Feedback and welcome to our community!

I am sorry, but I can not reproduce this behavior. Here you can see that your provided code example does raise an issue on SonarCloud:

https://sonarcloud.io/project/issues?resolved=false&types=VULNERABILITY&id=danielstestorganization_testproject&open=AYra3xgeRf6BBgbUaQc8

Can you double-check if you set any specific configurations for your scan/project?

Thanks again for your report!

Kind regards,

Daniel