I'm spending time trying to fix veracode scan flaw CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS).(我花时间试图修复Veracode扫描缺陷CWE-80在网页（基本XSS）中与脚本相关的HTML标签的不正确中和。)
What I do is an HTTP call to my backend in order to open a blob with a download file.(我要做的是对后端进行HTTP调用，以打开带有下载文件的Blob。)
const xhr = new XMLHttpRequest();
xhr.open("GET", url, true);
xhr.responseType = "arraybuffer";
xhr.onreadystatechange = () => {
if (xhr.readyState === 4 && xhr.status === 200) {
var windowUrl = window.URL || window.webkitURL;
var blobUrl = windowUrl.createObjectURL(new Blob([xhr.response]));
const doc = document.createElement('a');
document.body.appendChild(doc);
doc.href = blobUrl;
if (filename) {
doc.download = filename;
}
doc.click();
windowUrl.revokeObjectURL(url);
}
}
xhr.send();
veracode complains about this line(veracode抱怨这条线)
document.body.appendChild(doc);
This call to Node.appendChild() contains a cross-site scripting (XSS) flaw.(对Node.appendChild（）的此调用包含跨站点脚本（XSS）缺陷。) The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim's browser.(该应用程序使用不受信任的输入填充HTTP响应，从而使攻击者可以嵌入恶意内容，例如Javascript代码，这些恶意内容将在受害者的浏览器的上下文中执行。) XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis.(XSS漏洞通常被利用来窃取或操纵Cookie，修改内容表示并破坏机密信息，并定期发现新的攻击媒介。)
Not sure what kind of verification upon my response I need to apply.(不知道我的回复需要什么样的验证。)
ask by Ziko translate from so
与恶龙缠斗过久,自身亦成为恶龙；凝视深渊过久,深渊将回以凝视…
