DOM-based XSS
Cross-site scripting in which client-side script takes attacker-controlled data from a source such as location.hash or a postMessage event and writes it to a dangerous sink such as innerHTML or eval, so the payload may never reach the server. Use safe sinks such as textContent and enforce them with Trusted Types.
- Also called
- DOM XSS · DOM-based cross-site scripting
Covered in
Guide
Prevent DOM XSS, postMessage abuse and client-side injection
Trace attacker-controlled values from the URL, messages and storage to the browser APIs that parse HTML or run code, then close those sinks with safe APIs, a sanitizer, Trusted Types and strict message checks.
Guide
Render rich text without granting it application privileges
Choose text rendering or a restricted HTML policy, then test the final DOM after every transformation.
Practice: HTML sanitization lab: Configure a sanitizer for user comments