rspec/rules/S5696/common/pitfalls/modification-after-sanitization.adoc
Egon Okerman d34e1f86dd Modify rule S5696: Change text to progressive education format (APPSEC-423) (#1529)
* Move metadata

* Move message

* Add text

* Clarify text

* Reword method to property in context of innerHTML
2023-03-02 19:03:03 +01:00

4 lines
301 B
Plaintext

==== Modification after sanitization
Caution should be taken if the user-supplied data is further modified **after** this data was sanitized. Doing so might void the effects of sanitization and introduce new XSS vulnerabilities. In general, modification of this data should occur beforehand instead.