VBC-944: xss-href-injection

error

Category: security
Analysis: Regex (line by line)
File types: .js, .ts, .jsx, .tsx, .html, .astro
Scope: the whole file, with no scope filtering
Tags: security ai-error

What it reports

Dynamic href constructed with string interpolation at line {line}. If the value originates from user input or an untrusted source, this is a javascript: URL injection vector. Validate that URLs begin with http(s)😕/ or are relative paths before assigning to href.

Flagged

const link = `href="${untrusted}"`;

Not flagged

<a href={`mailto:${contact.email}`}>write to us</a>

<a href={`/blog/${slug}`}>read on</a>

<a href={`https://example.org/u/${user}`}>profile</a>

<link href={`${import.meta.env.BASE_URL}favicon.svg`} />

<a href={`${import.meta.env.BASE_URL}docs/${slug}`}>docs</a>

<a href="/static/page">page</a>

Pattern

href\s*=\s*\{[^}]*\+|href\s*=\s*[`'"]\s*\$\{(?!\s*import\.meta\.env\.)|href\s*=\s*\{\s*[`'"]\s*\$\{(?!\s*import\.meta\.env\.)