Cross-site scripting (ARCH3101)

Key typescript.security.xss · Severity error · Category security · CWE CWE-79

Writing untrusted data to HTML output without escaping (raw HTML sinks or innerHTML) lets attackers inject scripts, enabling cross-site scripting (XSS).

Incorrect

app.get("/hello", (req, res) => {
  // name="<script>steal()</script>"
  res.send(`<h1>Hello ${req.query.name}</h1>`);
});

Correct

import escapeHtml from "escape-html";

app.get("/hello", (req, res) => {
  res.send(`<h1>Hello ${escapeHtml(String(req.query.name))}</h1>`);
});

Fix

Escape user data before writing it into HTML; use template engines with auto-escaping.