Avoid unsafe `innerHTML` assignment

#Metadata

Rule ID

ts.security.no-innerhtml-assignment

Severity

high

Confidence

0.92

Languages

javascript, typescript

Presets

recommended, security, strict

Stability

stable

Applies to

block

Tags

output-encoding, rules-catalog, security, xss

#Why it matters

Direct HTML injection can allow untrusted or weakly reviewed content to execute in the browser.

#Remediation

Prefer text-only rendering APIs or assign only fixed or explicitly sanitized HTML.

#Repository path

The generated metadata points to critiq-rules/libs/rules/catalog/rules/typescript/ts.security.no-innerhtml-assignment.rule.yaml.