- Home
- The 17 checks
- Raw HTML goes straight onto the page
Raw HTML goes straight onto the page
In plain English: Your app shows text from users as raw HTML. Someone can hide a script in a comment or profile, and it runs in the browser of everyone who views it, which can steal their login. This is called XSS (cross-site scripting).
What happens if you ship it
A comment or profile field carries a script, and it runs in the browser of every visitor who sees it.
How to fix it technical
Let your AI tool fix it
Paste this into Lovable, Bolt, Cursor, Replit or Claude Code:
Fix this problem in my project: Raw HTML goes straight onto the page. Sanitise the value with DOMPurify before rendering it, or render it as plain text. Change only what this fix needs, then tell me what you changed and anything I have to do myself.Check your app
Run npx sigship in your project folder. It reports this problem as unsanitized-html, along with 16 other checks. Nothing leaves your computer. New to the terminal?
Questions
What is XSS?
Cross-site scripting: when an attacker gets their own code to run on your site in other people's browsers, usually through text your app shows without cleaning it first.
How do I fix it?
Show user text as plain text, or clean it with a library such as DOMPurify before showing it as HTML.