Avoid unsafe DOM HTML insertion sinks

#Metadata

Rule ID

ts.security.dangerous-insert-html

Severity

high

Confidence

0.92

Languages

javascript, typescript

Presets

recommended, security, strict

Stability

stable

Applies to

block

Tags

output-encoding, rules-catalog, security, xss

#Why it matters

HTML-capable DOM insertion sinks can execute attacker-controlled markup unless the HTML is fixed or strongly sanitized first.

#Remediation

Insert text with safe DOM APIs, or pass only fixed or explicitly sanitized HTML to the sink.

#Repository path

The generated metadata points to critiq-rules/libs/rules/catalog/rules/typescript/ts.security.dangerous-insert-html.rule.yaml.