VBC-941: missing-input-sanitization

warning

Category: security
Analysis: Regex (line by line)
File types: .js, .ts, .jsx, .tsx, .astro
Scope: source code only, ignoring anything inside strings and comments
Supersedes: VBC-070 on the same line
Tags: security ai-error

What it reports

Unsanitized HTML sink at line {line}. dangerouslySetInnerHTML, outerHTML and insertAdjacentHTML all bypass framework escaping. Sanitize with a library such as DOMPurify before assigning untrusted markup.

Flagged

<div dangerouslySetInnerHTML={{ __html: userHtml }} />

el.outerHTML = markup;

Not flagged

<div dangerouslySetInnerHTML={{ __html: "<b>static</b>" }} />

el.textContent = text;

Pattern

dangerouslySetInnerHTML\s*=\s*\{\{[^}]*__html\s*:\s*(?!\s|['\"`])|\.outerHTML\s*=(?!=)|\.insertAdjacentHTML\s*\(\s*[^,]+,\s*(?!\s|['\"`])