Veracode violation CWE ID 80 reported in stompjs

[sohonisaurabh]

Hi,

I am using stompjs on wrapped inside AngularJS 1.x to implement web socket communication. For every production deployment, Veracode static scan is run on the codebase to detect potential security violations in JS files.

In a recent scan, Veracode reported the violation given below:

The exact line of code where the violation is reported is given below (Line no. 164 and 170):

From my initial analysis, sanitizing the input would fix this issue.

Can someone help me with the correct fix?

Thanks,
Saurabh