security - Angular generating index.html file with relative css file imports - Stack Overflow

admin管理员组

文章数量:1304137

I am using Angular 16 and the production dist generated by Angular imports the styles.css in a relative fashion as below:

<link ref="stylesheet" href="styles-CXBDUENS.css" />

This has been flagged as a vulnerability (PRSSI) by our security team as per the Qualys scan. Refer the vulnerability here -

The expected import should be:

<link ref="stylesheet" href="/styles-CXBDUENS.css" />

with a leading slash at the start, which makes the import static from the root folder.

Is there any way to tell Angular to import it in the correct way.

Since, the build is generated via a CICD pipeline, the only workaround that I have currently is to modify the generated index.html file manually. Is there any better way to do this ?

I am using Angular 16 and the production dist generated by Angular imports the styles.css in a relative fashion as below:

<link ref="stylesheet" href="styles-CXBDUENS.css" />

This has been flagged as a vulnerability (PRSSI) by our security team as per the Qualys scan. Refer the vulnerability here - https://portswigger/kb/issues/00200328_path-relative-style-sheet-import

The expected import should be:

<link ref="stylesheet" href="/styles-CXBDUENS.css" />

with a leading slash at the start, which makes the import static from the root folder.

Is there any way to tell Angular to import it in the correct way.

Since, the build is generated via a CICD pipeline, the only workaround that I have currently is to modify the generated index.html file manually. Is there any better way to do this ?

• angular
• security
• stylesheet
• qualys

Share Improve this question Follow edited Feb 4 at 19:42 JSON Derulo 17.8k1111 gold badges5757 silver badges7575 bronze badges asked Feb 4 at 16:00 Saurabh TiwariSaurabh Tiwari 5,1611111 gold badges5050 silver badges9090 bronze badges

Add a comment  | 

1 Answer 1

Sorted by: Reset to default 0

You can use the --deploy-url option when running the ng build comand:

ng build --deploy-url=/

Alternatively, you can set the deployUrl build option in your angular.json to keep the CLI commands clean, but it does the same thing.

本文标签： securityAngular generating indexhtml file with relative css file importsStack Overflow