I am using Angular 16 and the production dist generated by Angular imports the styles.css in a relative fashion as below:

<link ref="stylesheet" href="styles-CXBDUENS.css" />

This has been flagged as a vulnerability (PRSSI) by our security team as per the Qualys scan. Refer the vulnerability here -

The expected import should be:

<link ref="stylesheet" href="/styles-CXBDUENS.css" />

with a leading slash at the start, which makes the import static from the root folder.

Is there any way to tell Angular to import it in the correct way.

Since, the build is generated via a CICD pipeline, the only workaround that I have currently is to modify the generated index.html file manually. Is there any better way to do this ?

I am using Angular 16 and the production dist generated by Angular imports the styles.css in a relative fashion as below:

<link ref="stylesheet" href="styles-CXBDUENS.css" />

This has been flagged as a vulnerability (PRSSI) by our security team as per the Qualys scan. Refer the vulnerability here - https://portswigger/kb/issues/00200328_path-relative-style-sheet-import

The expected import should be:

<link ref="stylesheet" href="/styles-CXBDUENS.css" />

with a leading slash at the start, which makes the import static from the root folder.

Is there any way to tell Angular to import it in the correct way.

Since, the build is generated via a CICD pipeline, the only workaround that I have currently is to modify the generated index.html file manually. Is there any better way to do this ?

• angular
• security
• stylesheet
• qualys

1 Answer 1

You can use the --deploy-url option when running the ng build comand:

ng build --deploy-url=/

Alternatively, you can set the deployUrl build option in your angular.json to keep the CLI commands clean, but it does the same thing.