Zennoxa Shield
Rules / JavaScript / TypeScript
SHIELD-JS-004

Cross-Site Scripting (XSS) via document.write

highJavaScript / TypeScriptCWE-79CVSS 7.4

What it detects

document.write with user input can allow script injection.

How to fix

Avoid document.write; use DOM manipulation methods instead.

Vulnerable — Shield flags thiswelcome.js
function showWelcome(name) {
  document.write("<h1>Welcome back, " + name + "</h1>");
}
Fixed — scans cleanwelcome.js
function showWelcome(name) {
  const heading = document.createElement("h1");
  heading.textContent = "Welcome back, " + name;
  document.body.appendChild(heading);
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-JS-004, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-JS-004: Cross-Site Scripting (XSS) via document.write — Zennoxa Shield