The tags stem from how the Fortify mapper doesn't seem to clean up the XML tags that are converted and used in its mappings. Adding a tag filter on the HTML export side removes these tags to mirror how we do things on the frontend, but it does seem like some context is lost as a result of the tags encoding some information.

EX)

• Pre-filter:
  <Content><Paragraph>Attackers are able to control the file system path argument to <Replace key="PrimaryCall.name"/> at <Replace key="PrimaryLocation.file"/> line <Replace key="PrimaryLocation.line"/>, which allows them to access or modify otherwise protected files.<AltParagraph>Allowing user input to control paths used in file system operations could enable an attacker to access or modify otherwise protected system resources.</AltParagraph></Paragraph></Content>

• Post-filter:
  Attackers are able to control the file system path argument to at line , which allows them to access or modify otherwise protected files.Allowing user input to control paths used in file system operations could enable an attacker to access or modify otherwise protected system resources.

As this behavior is mirrored on the frontend as well, I recommend addressing this issue in a rework of the Fortify mapper instead.

Pivoting this to instead remove tag cleaning on Heimdall frontend.

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud