OWASP / OWASP/ASVS

Clarification: 3.2.2 Incompatible with Modern SPA Framework Practices

Open
#3,224 26 comments 1 reaction 1 assignee View on GitHub

@tghosth is already working on this.

Since Aug 5, 2025.

4) proposal for review requires change control V1 (prev V5) v5.0.1
Dominant language
HTML
Stars
3.6k
Forks
831
Avg merge
7h 55m
Merged PRs (30d)
4

Description

Verify that content intended to be displayed as text, rather than rendered as
HTML, is handled using safe rendering functions (such as createTextNode or
textContent) to prevent unintended execution of content such as HTML or
JavaScript.

In Single Page Application frameworks like react, vue, angular, using textContent or createTextNode manually is uncommon and unnecessary unless doing manual DOM manipulation. These API violates the declarative nature of Modern SPA frameworks, where rendering is handled through templating systems or virtual DOM abstractions. Forcing to use textContent discourages declarative UI and reusable components, and unnecessary complexity. Modern SPA frameworks automatically escape untrusted data during rendering by default, safe rendering is already inherently addressed.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.