Fix unsanitised HTML (`dangerouslySetInnerHTML`, `v-html`)

Rendering a variable as HTML lets user input run script in your users' sessions. Sanitise it or render text.

Rule: `xss/unsanitised-html` (high)

What muster-check saw

``` HIGH dangerouslySetInnerHTML renders a value that is not a constant src/config.ts:2 dangerouslySetInnerHTML: x ``` Constant strings and `JSON.stringify(...)` (JSON-LD) are skipped.

Fix

Prefer text: `<div>{value}</div>`; React/Vue escape it.
If you need rich text, sanitise at render: `DOMPurify.sanitize(value)`; keep it server-trusted where possible.

Prove it's fixed

In your local app, store `<img src=x onerror=alert(1)>` in the field that feeds the sink, load the page, and confirm no dialog fires and the markup appears as text or is stripped. Keep it as a regression test.

Limits

Static: it flags the sink, not whether user input actually reaches it. It can flag safe values (false positive) and can't see sinks built dynamically. Proving reachability needs the running app.

Run this checklist automatically, on every deploy.

Muster proves each finding with the exact request that worked and the fix that closes it. First findings in about 10 minutes, free.

Start free →