I'm scanning one of our projects for vulnerabilities and Veracode identified CWE-80 & CWE-601 in spring-security-webauthn.js on line 199 for "Improper Neutralization of Script-Related HTML Tags in a Web Page" and "URL Redirection to Untrusted Site" respectively.

By performing the redirect inline without creating the variable it is able to pass the SAST scan as it no longer matches the pattern. This was done by slightly modifying the authenticateOrError function from this:

async function authenticateOrError(headers, contextPath, useConditionalMediation) {
  try {
    const redirectUrl = await webauthn.authenticate(headers, contextPath, useConditionalMediation);
    window.location.href = redirectUrl;
  } catch (err) {
    console.error(err);
    window.location.href = `${contextPath}/login?error`;
  }
}

to this:

async function authenticateOrError(headers, contextPath, useConditionalMediation) {
  try {
    window.location.href = await webauthn.authenticate(headers, contextPath, useConditionalMediation);
  } catch (err) {
    console.error(err);
    window.location.href = `${contextPath}/login?error`;
  }
}

My assumption is that the original code itself is innocuous and shouldn't be an issue. Where this doesn't change any functionality it may be worth the addition and remove the false positive in the scan results. But it's definitely something that should be validated.

Thoughts and feedback are welcome