innerHTML Has Five Doors. Most Reviews Only Watch One.
I have reviewed the same line of code, written five different ways, and caught it once. The line is element.innerHTML = something . I catch it when something is obviously a URL parameter. I miss it when something arrived four frames ago through a message event, got stored, and is written to the DOM by a function in a different file. The sink was identical every time. My attention was not. Sinks…
The innerHTML property of an HTML element can be used to insert content into the DOM, but it poses a significant security risk when untrusted data is involved. This is because innerHTML can execute code contained in the inserted data, leading to cross-site scripting (XSS) vulnerabilities. Despite this risk, developers often overlook proper validation and sanitization of data before using innerHTML, as it is a common and seemingly harmless approach.
The issue stems from the fact that the source of untrusted data is not easily identifiable, as it can come from various origins such as URL parameters, message events, file uploads, WebSockets, or workers. To mitigate these risks, developers should focus on identifying the sources of untrusted data and ensuring that appropriate trust checks are in place at the sink, which is where the data is inserted into the DOM using innerHTML.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
