Skip to content

VBC-902: document-write-slop

error

Category: security
Analysis: Regex (line by line)
File types: .js, .ts, .tsx, .astro
Scope: source code only, ignoring anything inside strings and comments
Tags: security performance

What it reports

document.write() is prohibited at line {line}. It is insecure and performance-heavy.

Flagged

js
document.write("<p>hi</p>");

Not flagged

js
container.append(paragraph);

Pattern

regex
document\.write\(

Released under the MIT License.