CODEWITHSUNDEEP
angularsecuritystylesheetqualys
Saurabh Tiwari
Saurabh Tiwari

Reputation: 5141

Angular generating index.html file with relative css file imports

I am using Angular 16 and the production dist generated by Angular imports the styles.css in a relative fashion as below:

<link ref="stylesheet" href="styles-CXBDUENS.css" />

This has been flagged as a vulnerability (PRSSI) by our security team as per the Qualys scan. Refer the vulnerability here - https://portswigger.net/kb/issues/00200328_path-relative-style-sheet-import

The expected import should be:

<link ref="stylesheet" href="/styles-CXBDUENS.css" />

with a leading slash at the start, which makes the import static from the root folder.

Is there any way to tell Angular to import it in the correct way.

Since, the build is generated via a CICD pipeline, the only workaround that I have currently is to modify the generated index.html file manually. Is there any better way to do this ?

Upvotes: 0

Views: 18

Answers (1)

JSON Derulo
JSON Derulo

Reputation: 17558

You can use the --deploy-url option when running the ng build comand:

ng build --deploy-url=/

Alternatively, you can set the deployUrl build option in your angular.json to keep the CLI commands clean, but it does the same thing.

Upvotes: 0

Related Questions