> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codeant.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> **raw-html-join**
>
> User controlled data in a HTML string may result in XSS\
> **Likelihood**: LOW\
> **Confidence**: LOW\
> **CWE**: \
> \- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
> \
> **OWASP**: \
> \- A07:2017 - Cross-Site Scripting (XSS)
> \
> \- A03:2021 - Injection

> **insecure-innerhtml**
>
> User controlled data in a `$EL.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities\
> **Likelihood**: LOW\
> **Confidence**: LOW\
> **CWE**: \
> \- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
> \
> **OWASP**: \
> \- A07:2017 - Cross-Site Scripting (XSS)
> \
> \- A03:2021 - Injection

> **dom-based-xss**
>
> Detected possible DOM-based XSS. This occurs because a portion of the URL is being used to construct an element added directly to the page. For example, a malicious actor could send someone a link like this: [http://www.some.site/page.html?default=](http://www.some.site/page.html?default=) which would add the script to the page. Consider allowlisting appropriate values or using an approach which does not involve the URL.\
> **Likelihood**: LOW\
> **Confidence**: LOW\
> **CWE**: \
> \- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
> \
> **OWASP**: \
> \- A07:2017 - Cross-Site Scripting (XSS)
> \
> \- A03:2021 - Injection

> **insecure-document-method**
>
> User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities\
> **Likelihood**: LOW\
> **Confidence**: LOW\
> **CWE**: \
> \- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
> \
> **OWASP**: \
> \- A07:2017 - Cross-Site Scripting (XSS)
> \
> \- A03:2021 - Injection

> **js-open-redirect-from-function**
>
> The application accepts potentially user-controlled input `$PROP` which can control the location of the current window context. This can lead two types of vulnerabilities open-redirection and Cross-Site-Scripting (XSS) with JavaScript URIs. It is recommended to validate user-controllable input before allowing it to control the redirection.\
> **Likelihood**: LOW\
> **Confidence**: LOW\
> **CWE**: \
> \- CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
> \
> **OWASP**: \
> \- A01:2021 - Broken Access Control

> **eval-detected**
>
> Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.\
> **Likelihood**: LOW\
> **Confidence**: LOW\
> **CWE**: \
> \- CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
> \
> **OWASP**: \
> \- A03:2021 - Injection

> **wildcard-postmessage-configuration**
>
> The target origin of the window\.postMessage() API is set to "\*". This could allow for information disclosure due to the possibility of any origin allowed to receive the message.\
> **Likelihood**: HIGH\
> **Confidence**: MEDIUM\
> **CWE**: \
> \- CWE-345: Insufficient Verification of Data Authenticity
> \
> **OWASP**: \
> \- A08:2021 - Software and Data Integrity Failures

> **js-open-redirect**
>
> The application accepts potentially user-controlled input `$PROP` which can control the location of the current window context. This can lead two types of vulnerabilities open-redirection and Cross-Site-Scripting (XSS) with JavaScript URIs. It is recommended to validate user-controllable input before allowing it to control the redirection.\
> **Likelihood**: HIGH\
> **Confidence**: HIGH\
> **CWE**: \
> \- CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
> \
> **OWASP**: \
> \- A01:2021 - Broken Access Control

> **insufficient-postmessage-origin-validation**
>
> No validation of origin is done by the addEventListener API. It may be possible to exploit this flaw to perform Cross Origin attacks such as Cross-Site Scripting(XSS).\
> **Likelihood**: LOW\
> **Confidence**: LOW\
> **CWE**: \
> \- CWE-345: Insufficient Verification of Data Authenticity
> \
> **OWASP**: \
> \- A08:2021 - Software and Data Integrity Failures

> **raw-html-concat**
>
> User controlled data in a HTML string may result in XSS\
> **Likelihood**: MEDIUM\
> **Confidence**: MEDIUM\
> **CWE**: \
> \- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
> \
> **OWASP**: \
> \- A07:2017 - Cross-Site Scripting (XSS)
> \
> \- A03:2021 - Injection


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.