> For the complete documentation index, see [llms.txt](https://docs.sec1.io/user-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sec1.io/user-docs/4-sast/3-javascript/usage-of-manual-html-sanitization-xss.md).

# Usage of manual HTML sanitization (XSS)

## Overview

* **Rule ID**: `javascript_lang_manual_html_sanitization`
* **Applicable Languages**: Javascriptscript
* **Weakness ID**: CWE-79

## Description

Manually sanitizing HTML is error-prone and can result in Cross-Site Scripting (XSS) vulnerabilities. This happens when user input is not adequately sanitized, enabling attackers to inject malicious scripts into web pages that are viewed by other users.

## Remediation Guidelines

* **Avoid** manually escaping HTML to sanitize user input, as this method is unreliable and may overlook certain exploits. For example, using:

  ```java
  const sanitizedUserInput = user.Input
    .replaceAll('<', '&lt;')
    .replaceAll('>', '&gt;'); // unsafe
  const html = `<strong>${sanitizedUserInput}</strong>`;


  ```
* **Instead, use a trusted HTML sanitization library** to handle user input safely. These libraries are designed to be more reliable and address a broad range of XSS attack vectors.

  ```java
  import sanitizeHtml from 'sanitize-html';

  const html = sanitizeHtml(`<strong>${user.Input}</strong>`);
  ```

## References

* [**OWASP XSS explained**](https://owasp.org/www-community/attacks/xss/)
* [**CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')**](https://cwe.mitre.org/data/definitions/79.html)
* [**OWASP Top 10: A03:2021 - Injection**](https://owasp.org/Top10/A03_2021-Injection/)

## Configuration

To omit this rule during a scan, and to provide you with continuous 24/7 code-level scanning, you can employ our [**SAST TOOL**](https://scopy.sec1.io/login)