DOM innerHTML XSS to textContent

Name: dom-innerhtml-xss-to-textcontent codemod
Availability: InStock

A security-focused codemod that prevents XSS vulnerabilities by replacing dangerous innerHTML assignments with safe alternatives like textContent or proper DOM manipulation methods.

🚨 Security Issue

Using innerHTML with user-controlled data creates Cross-Site Scripting (XSS) vulnerabilities. This codemod identifies and fixes patterns where user input could be executed as HTML, replacing them with safe alternatives.

CWE-79: Cross-site Scripting (XSS) - https://cwe.mitre.org/data/definitions/79.html

Installation

bash

What it does

✅ Transforms dangerous patterns

Before:

javascript

After:

javascript

❌ Preserves safe patterns

The codemod will NOT transform these safe patterns:

javascript

Examples

Form Input Handling

javascript

URL Parameter Display

javascript

API Response Handling

javascript

Scope

This codemod targets:

✅ JavaScript files in browser contexts
✅ TypeScript files targeting browser environments
✅ HTML files with inline JavaScript
✅ Frontend framework components using direct DOM access
✅ Files with URL parameter parsing or form input handling
✅ API response handlers that update DOM content

Limitations

Does not analyze data flow to determine if variables contain user input
Uses heuristics to detect potentially dangerous assignments
Conservative approach: transforms all non-static innerHTML assignments
May require manual review for complex HTML generation use cases

Development

bash

References

License

MIT

Registry

Ready to contribute?

codemod/dom-innerhtml-xss-to-textcontent

Run locally