SecurityHigh

Unsanitized HTML Rendered

src/client/review.ts:31

What's going on

Client review comments are injected into the DOM via innerHTML without sanitization, creating a stored XSS channel.

Why it matters

Stored XSS lets any commenter run arbitrary script for every visitor, making it one of the most damaging bugs a marketplace can ship.

src/client/review.ts:31

Recommended Fix

Replace the inline query with a parameterized statement and validate the id before it ever reaches the database. A regression test is generated alongside the patch.

Before

1function renderReview(comment: string, el: HTMLElement) {2  el.innerHTML = `<p>${comment}</p>`; // dangerous3}

After

1function renderReview(comment: string, el: HTMLElement) {2  const p = el.querySelector("p");3  if (p) p.textContent = comment; // safe4}

Uploaddone
Analyzedone
Finddone
Explainactive
Fixupcoming
Testupcoming
Verifyupcoming