{
  "id": 300435,
  "title": "innerHTML Has Five Doors. Most Reviews Only Watch One.",
  "url": "https://urgent.news/2026/08/08/innerhtml-has-five-doors-most-reviews-only-watch-one",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-08T08:19:02.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/ofri-peretz/innerhtml-has-five-doors-most-reviews-only-watch-one-587c"
  },
  "original_language": "en",
  "account": "The innerHTML property of an HTML element can be used to insert content into the DOM, but it poses a significant security risk when untrusted data is involved. This is because innerHTML can execute code contained in the inserted data, leading to cross-site scripting (XSS) vulnerabilities. Despite this risk, developers often overlook proper validation and sanitization of data before using innerHTML, as it is a common and seemingly harmless approach. The issue stems from the fact that the source of untrusted data is not easily identifiable, as it can come from various origins such as URL parameters, message events, file uploads, WebSockets, or workers. To mitigate these risks, developers should focus on identifying the sources of untrusted data and ensuring that appropriate trust checks are in place at the sink, which is where the data is inserted into the DOM using innerHTML.",
  "summary": "I have reviewed the same line of code, written five different ways, and caught it once. The line is element.innerHTML = something . I catch it when something is obviously a URL parameter. I miss it when something arrived four frames ago through a message event, got stored, and is written to the DOM by a function in a different file. The sink was identical every time. My attention was not. Sinks…",
  "key_points": [
    "innerHTML can insert content into DOM",
    "Risks XSS vulnerabilities with untrusted data",
    "Developers often neglect validation and sanitization"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}