VBC-070: use-innerhtml

error

Category: core
Analysis: Regex (whole file)
File types: .js, .ts, .tsx, .astro
Scope: source code only, ignoring anything inside strings and comments
Excluded paths: **/test/**, **/tests/**, **/__tests__/**, **/*.test.*, **/*.spec.*
Tags: security

What it reports

Use of 'innerHTML' detected at line {line}. Use 'textContent' or a sanitizer to avoid XSS.

Flagged

el.innerHTML = markup;

el.innerHTML = "<b>" + name + "</b>";

el.innerHTML = `<b>${name}</b>`;

el.innerHTML = `
  <p class="muted">Hello</p>
  <b>${name}</b>
`;

el.innerHTML = `<b>` + name + `</b>`;

Not flagged

el.textContent = text;

alert.innerHTML = '<i class="fa-check"></i> <span id="t"></span>';

panel.innerHTML = `
  <p class="muted">Webhook service unavailable</p>
`;

box.innerHTML = `<i class="x"></i>`;

el.innerHTML = "";

el.innerHTML =
  "Tip: try <code>/status</code>, " +
  "or <code>/help</code> for all commands.";

if (el.innerHTML === "") { init(); }

Pattern

\.innerHTML\s*=(?!=)(?!\s*(?:(['"])(?:(?!\1)[^\\])*\1|`(?:[^`\\$]|\\[\s\S]|\$(?!\{))*`|\s|\+)+[;\n])