Checks · HYG-005

HYG-005 · dangerouslySetInnerHTML with user input

Why it matters

Writing user text into HTML lets a visitor run script in another visitor's browser.

How we detect it

A taint rule follows user input into dangerouslySetInnerHTML.

How we fix it

Render text, or sanitise with a maintained library if HTML is required.

Can it be fixed automatically? Yes, with a template change

Related checks

• SEC-007 · Source maps public in production
• DB-008 · Migrations not in repo
• HDR-001 · Missing HSTS
• HDR-002 · Missing CSP