WEBUI-1510: Own Code Static Scan : Cross-Site Scripting (XSS)

nuxeo · May 17, 2024 · e1ff632 · e1ff632
1 parent a8019bf
commit e1ff632
Showing 1 changed file with 2 additions and 4 deletions.
diff --git a/elements/nuxeo-document-creation/nuxeo-document-creation-behavior.js b/elements/nuxeo-document-creation/nuxeo-document-creation-behavior.js
@@ -84,10 +84,8 @@ export const DocumentCreationBehavior = [
 
     newDocument(type, properties) {
       if (!schemaFetcher) {
-        schemaFetcher = document.createElement('div');
-        schemaFetcher.innerHTML = '<nuxeo-resource></nuxeo-resource>';
-        this.shadowRoot.appendChild(schemaFetcher);
-        [schemaFetcher] = schemaFetcher.getElementsByTagName('nuxeo-resource');
+        schemaFetcher = document.createElement('nuxeo-resource');
+        document.body.appendChild(schemaFetcher);
       }
       schemaFetcher.path = `path/${this.targetPath}/@emptyWithDefault`;
       schemaFetcher.params = { type: this.selectedDocType.type };