No dynamic script injection with user-controlled content

Dynamic DOM injection — document.write(), innerHTML assignments with external content, and dynamically created <script> elements with user-controlled sources — creates XSS vulnerabilities that CSP cannot fully mitigate. An attacker who controls any input to these patterns achieves script execution in the user's browser context: session token theft, credential harvesting, or full account takeover. CWE-79 (XSS) and CWE-83 (Script in HTML Attribute) both apply directly. OWASP A03 (Injection) lists DOM-based XSS as a primary injection vector. These patterns persist in codebases long after their introduction because they appear to work correctly during normal operation — failures only surface under adversarial input.

Replace DOM injection patterns with safe equivalents. Text content should use textContent; structured content should use the DOM API or framework rendering.

// DANGEROUS: XSS vector
element.innerHTML = apiResponse.html
document.write('<script src=' + userInput + '></script>')

// SAFE: text only
element.textContent = apiResponse.text

// SAFE: structured DOM construction
const p = document.createElement('p')
p.textContent = apiResponse.title
container.appendChild(p)

// SAFE: React auto-escapes
return <div>{apiResponse.content}</div>

// LAST RESORT: sanitized HTML (treat as tech debt)
import DOMPurify from 'dompurify'
element.innerHTML = DOMPurify.sanitize(apiResponse.html)

DOMPurify reduces risk but does not eliminate the injection pattern — flag every innerHTML assignment in code review regardless of sanitization.