Fortify scan raised a flag in axios.js file where setAttribute ('href' href) has been used. It is suggesting to validate data which passes through this setAttribute ('href' href).

Please also note, that getElement().setAttribute('role', 'custom-role') should only affect the <vaadin-button> element, not the <button> one embedded within. So, if the aim is to alter the latter, ...