Avoid manual sanitization of inputs

Docs > Code Analysis > Static Analysis Rules > Avoid manual sanitization of inputs

This page is not yet available in Spanish. We are working on its translation.
If you have any questions or feedback about our current translation project, feel free to reach out to us!

Metadata

ID: typescript-browser-security/manual-sanitization

Language: TypeScript

Severity: Warning

Category: Security

CWE: 79

Description

Never sanitize HTML input manually. This can lead to vulnerabilities. Use dedicated modules such as sanitize-html to sanitize user inputs.

Non-Compliant Code Examples

const sanitizedInput = input
  .replaceAll('<', '&lt;')
  .replaceAll('>', '&gt;');
const html = `<strong>${sanitizedInput}</strong>`;

const sanitizedInput2 = input
  .replaceAll('bla', '&lt;')
  .replaceAll('foo', '&gt;');

const sanitizedInput3 = input
  .replaceAll('<', '&lt')
  .replaceAll('>', 'gt;');

Compliant Code Examples

import sanitizeHtml from 'sanitize-html';

const html = sanitizeHtml(`<strong>${input}</strong>`);