> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codeant.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Xss

<AccordionGroup>
  <Accordion title="avoid-content-tag">
    'content\_tag()' bypasses HTML escaping for some portion of the content. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here. If you must do this, create your HTML manually and use 'html\_safe'. Ensure no external data enters the HTML-safe string!<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    <br />**OWASP**: <br />- A07:2017 - Cross-Site Scripting (XSS)
    <br />- A03:2021 - Injection
  </Accordion>

  <Accordion title="avoid-render-inline">
    'render inline: ...' renders an entire ERB template inline and is dangerous. If external data can reach here, this exposes your application to server-side template injection (SSTI) or cross-site scripting (XSS) attacks. Instead, consider using a partial or another safe rendering method.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    <br />**OWASP**: <br />- A07:2017 - Cross-Site Scripting (XSS)
    <br />- A03:2021 - Injection
  </Accordion>

  <Accordion title="avoid-link-to">
    This code includes user input in `link_to`. In Rails 2.x, the body of `link_to` is not escaped. This means that user input which reaches the body will be executed when the HTML is rendered. Even in other versions, values starting with `javascript:` or `data:` are not escaped. It is better to create and use a safer function which checks the body argument.<br />**Likelihood**: HIGH<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    <br />**OWASP**: <br />- A07:2017 - Cross-Site Scripting (XSS)
    <br />- A03:2021 - Injection
  </Accordion>

  <Accordion title="avoid-html-safe">
    'html\_safe()' does not make the supplied string safe. 'html\_safe()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    <br />**OWASP**: <br />- A07:2017 - Cross-Site Scripting (XSS)
    <br />- A03:2021 - Injection
  </Accordion>

  <Accordion title="manual-template-creation">
    Detected manual creation of an ERB template. Manual creation of templates may expose your application to server-side template injection (SSTI) or cross-site scripting (XSS) attacks if user input is used to create the template. Instead, create a '.erb' template file and use 'render'.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    <br />**OWASP**: <br />- A07:2017 - Cross-Site Scripting (XSS)
    <br />- A03:2021 - Injection
  </Accordion>

  <Accordion title="avoid-raw">
    'raw()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. If you must do this, construct individual strings and mark them as safe for HTML rendering with `html_safe()`.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    <br />**OWASP**: <br />- A07:2017 - Cross-Site Scripting (XSS)
    <br />- A03:2021 - Injection
  </Accordion>

  <Accordion title="avoid-redirect">
    When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect.<br />**Likelihood**: MEDIUM<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
    <br />**OWASP**: <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="avoid-default-routes">
    Default routes are enabled in this routes file. This means any public method on a controller can be called as an action. It is very easy to accidentally expose a method you didn't mean to. Instead, remove this line and explicitly include all routes you intend external users to follow.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-276: Incorrect Default Permissions
    <br />**OWASP**: <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="avoid-render-text">
    'render text: ...' actually sets the content-type to 'text/html'. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Instead, use 'render plain: ...' to render non-HTML text.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    <br />**OWASP**: <br />- A07:2017 - Cross-Site Scripting (XSS)
    <br />- A03:2021 - Injection
  </Accordion>

  <Accordion title="avoid-render-dynamic-path">
    Avoid rendering user input. It may be possible for a malicious user to input a path that lets them access a template they shouldn't. To prevent this, check dynamic template paths against a predefined allowlist to make sure it's an allowed template.<br />**Likelihood**: HIGH<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>
</AccordionGroup>