The HCL AppScan displays shows a security issue when using window.open with a dynamic link being passed in, such as one for tracking a Lyft Trip or Uber Trip based on the trip in our system, but when I hardcode the link to something like stackoverflow.com, then the security scan is fine with it.. so I’m wondering if there is a way to actually fix this, other than only using window.open with a hardcoded link, or if this is a false positive.

One thing I’ve found from doing research, was that you can add ‘navigate-to’ to the security policy to only allow certain links to open, but even with that added, the HCL AppScan still doesn’t like that the link is dyanamic here. I’ve attached screenshots to show what I’m talking about below:

Another thing that can be done to get around the appScan security issue, is do the following.. but it doesn’t seem like a very good solution, since it seems to just be a workaround, so I’ve come here to look for advice and second opinions on this issue.