CodeAnt AI home pagelight logodark logo
  • Dashboard
  • Dashboard
  • Documentation
  • Demo Call with CEO
  • Blog
  • Slack
  • Get Started
    • CodeAnt AI
    • Setup
    • Control Center
    • Pull Request Review
    • IDE
    • Compliance
    • Anti-Patterns
    • Code Governance
    • Infrastructure Security Database
    • Application Security Database
      • Apex
      • Bash
      • C
      • Clojure
      • Cpp
      • Csharp
      • Dockerfile
      • Elixir
        • Lang
          • Best practice
          • Correctness
          • Correctness
          • Security
            • Command-injection
            • Rce-code
            • Rce-eex
            • Sql-injection
            • Traversal-file
            • Traversal-send-download
            • Traversal-send-file
            • Unsafe-atom-interpolation
            • Unsafe-binary-to-term
            • Xss-content-type
            • Xss-controller-html
            • Xss-raw
              • Xss raw
        • Phoenix
      • Fingerprints
      • Generic
      • Go
      • Html
      • Java
      • Javascript
      • Json
      • Kotlin
      • Ocaml
      • Php
      • Problem-based-packs
      • Python
      • Ruby
      • Rust
      • Scala
      • Solidity
      • Swift
      • Terraform
      • Typescript
      • Yaml
    Xss-raw

    Xss raw

    ‘raw’ renders raw HTML, as the name implies. This means that normal HTML escaping is bypassed. If user data can be controlled here, this exposes your application to cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize the data first.
    Likelihood: LOW
    Confidence: LOW
    CWE:
    - CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
    OWASP:
    - A03:2021 - Injection

    Xss controller htmlAction reuse csrf
    twitterlinkedin
    Powered by Mintlify