Fixing Vulnerability A Fortify Scan finds a critical Cross-Site Scrip… (#2451)

* Fixing Vulnerability A Fortify Scan finds a critical Cross-Site Scripting

* use var insted of const

lib/helpers/isURLSameOrigin.js

 'use strict';
 
 var utils = require('./../utils');
+var isValidXss = require('./isValidXss');
 
 module.exports = (
   utils.isStandardBrowserEnv() ?
@@ -27,6 +28,8 @@ module.exports = (
           href = urlParsingNode.href;
         }
 
+        isValidXss(url);
+
         urlParsingNode.setAttribute('href', href);
 
         // urlParsingNode provides the UrlUtils interface - http://url.spec.whatwg.org/#urlutils

lib/helpers/isValidXss.js

+'use strict';
+
+module.exports = function isValidXss(requestURL) {
+  var regex = RegExp('<script+.*>+.*<\/script>');
+  return regex.test(requestURL);
+};

test/specs/helpers/isURLSameOrigin.spec.js

@@ -8,4 +8,8 @@ describe('helpers::isURLSameOrigin', function () {
   it('should detect different origin', function () {
     expect(isURLSameOrigin('https://github.com/axios/axios')).toEqual(false);
   });
+
+  it('should detect xss', function () {
+    expect(isURLSameOrigin('https://github.com/axios/axios?<script>alert("hello")</script>')).toEqual(false)
+  })
 });