VBC-070: use-innerhtml

error

Category: core
Analysis: Regex (whole file)
File types: .js, .ts, .tsx, .astro
Scope: source code only, ignoring anything inside strings and comments
Excluded paths: **/test/**, **/tests/**, **/__tests__/**, **/*.test.*, **/*.spec.*
Tags: security

What it reports

Use of 'innerHTML' detected at line {line}. Use 'textContent' or a sanitizer to avoid XSS.

Flagged

el.innerHTML = markup;

el.innerHTML = "<b>" + name + "</b>";

el.innerHTML = `<b>${name}</b>`;

Not flagged

el.textContent = text;

alert.innerHTML = '<i class="fa-check"></i> <span id="t"></span>';

el.innerHTML = "";

el.innerHTML =
  "Tip: try <code>/status</code>, " +
  "or <code>/help</code> for all commands.";

if (el.innerHTML === "") { init(); }

Pattern

\.innerHTML\s*=(?!=)(?!\s*(?:(['"])(?:(?!\1)[^\\])*\1|\s|\+)+[;\n])