checkmarx make angular ssr as a xss

I used checkmarx under Angular 17, and in Angular 17 project, I enabled SSR with default server.ts, but the line code below will throw issue related with XSS.

// All regular routes use the Angular engine
server.get('*', (req, res, next) => {
const { protocol, originalUrl, baseUrl, headers } = req;

commonEngine
.render({
//bootstrap,
documentFilePath: indexHtml,
url: `${protocol}://${headers.host}${originalUrl}`,
publicPath: distFolder,
providers: [
{ provide: APP_BASE_HREF, useValue: baseUrl },],
})
.then((html) => res.send(html))
.catch((err) => next(err));
});




Continue reading...