Question
Help fix security vulnerability in RH Output
We use the Responsive HTML5 output generated using Robohelp 2019. Our security team brought issues related to ehlpdhtm.js and mhtopic.js files.
For the ehlpdhtm.js file:
- Unrestricted target for cross-origin message - A malicious site can intercept the message by changing the location of the window. In requestUpdateLinks: Sending a cross-origin message without restricting the origin that can receive it.
- Unchecked origin of message event - An attacker can send arbitrary data via event messages, which may lead to DOM-XSS or other injection-based client-side security issues. In onRcvContentSizeMsg: A 'message' handler does not check the origin of its received message event.
In the mhtopic.js file:
URL manipulation - An attacker may access unintended server-side functionality or make the application access a malicious website. In setRelStartPage: Constructing an HTTP request URL using a user-controllable string.
Does anyone know how to fix this? Anything we can do when authoring the Help?
AdChoices