LeapFix

☰
Home

⚠️ XSS via Unsanitized Output - DOMPurify

Severity: Medium
Score: 6.5
Accurracy: Confirmed
Language: TypeScript
CVSS v3.1: /AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Potential XSS vulnerability detected due to unsanitized output. Outputting untrusted data directly into HTML without proper sanitization can lead to XSS vulnerabilities. In this example for React, we have an XSS vulnerability that does not use the means of protection for special characters. Putting the application at risk.

👾 Vulnerable Code

📋 Copy 
...
<div>{{ userInput }}</div>
...


This example "how to fix your code!"
Ensure that user input is properly sanitized using functions like DOMPurify to protect your application from future attacks.
This is just example:

🛠️ How to fix

📋 Copy 
...
<div>{{ DOMPurify.sanitize(userInput) }}</div>
...