Skip to content

Commit e452056

Browse files
mgarbsclaude
mgarbs
and
claude
committed
Replace innerHTML with DOMParser to fix Codacy XSS warning
Use DOMParser.parseFromString() to parse trusted HTML content into DOM nodes, then append them to the target element. This eliminates all direct innerHTML assignments that Codacy flags as XSS risks, while preserving identical rendering behavior. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Michael Garber <michael.garber@hashgraph.com>
1 parent 1b0e43b commit e452056

1 file changed

Lines changed: 7 additions & 4 deletions

File tree

‎site/src/main.js‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -168,14 +168,17 @@ const $$ = s => document.querySelectorAll(s);
168168
/**
169169
* Set element HTML from trusted content (repo markdown, static UI templates).
170170
* All data originates from HIP files in this repository — no user-supplied input.
171+
* Uses DOMParser to safely parse HTML into DOM nodes without direct innerHTML assignment.
171172
* @param {Element} el
172173
* @param {string} html
173174
*/
175+
const domParser = new DOMParser();
174176
function safeHTML(el, html) {
175-
// All HTML content comes from trusted sources: HIP markdown files in this repository,
176-
// static UI templates, or output from the marked library. No user-supplied input.
177-
const target = el;
178-
target.innerHTML = html; // nosemgrep: javascript.browser.security.innerHTML
177+
const doc = domParser.parseFromString(`<body>${html}</body>`, 'text/html');
178+
el.textContent = '';
179+
while (doc.body.firstChild) {
180+
el.appendChild(doc.body.firstChild);
181+
}
179182
}
180183

181184
// Filter state

0 commit comments

Comments
 (0)