highScripts injected into your pages

HTML Inserted Without Sanitising

Text that may come from a user is placed into the page as live HTML.

Why it matters

Anything inserted as HTML is executed as HTML, including scripts. If the text came from another user, a form or an external service, that user can run code in every visitor's browser. Rendering it as text, or sanitising it first, keeps the feature and removes the problem.

What it looks like

This is the shape of code that triggers the rule. AI tools produce it because it works, and nothing tells them it is unsafe.

dangerouslySetInnerHTML with a variable
export function Bio({ user }) {
  return <div dangerouslySetInnerHTML={{ __html: user.bio }} />;
}

The smallest fix

minimal patch
// Render as text instead of HTML wherever possible:
<p>{user.bio}</p>

// If you need HTML (markdown, rich text), sanitise first:
import DOMPurify from 'isomorphic-dompurify';
<div dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(html) }} />

The better fix

If you have a few more minutes, this is the approach that holds up as the app grows.

safe alternative
// For markdown, use a renderer that escapes by default and a sanitiser
// plugin (react-markdown with rehype-sanitize), and send a
// Content-Security-Policy header so a slip cannot execute scripts.

Let your AI tool fix it

When the scanner finds this in your project, it fills in the file and line for you. This is the prompt it gives you to paste into Claude Code, Cursor or whatever you use.

In [the file] at line [the line number] content is inserted as raw HTML: [the flagged code]. If it does not need to be HTML, render it as text. If it does, pass it through DOMPurify.sanitize (or rehype-sanitize for markdown) before inserting it. Add a test that inserts a string containing a script tag and asserts it is rendered inert.

How to check the fix worked

1. Save a value containing "<img src=x onerror=alert(1)>" through the
   feature and view it. No dialog must appear and the tag must be
   shown or stripped.
2. Confirm legitimate formatting (bold, links) still renders.

Further reading