Clarification: 3.2.2 Incompatible with Modern SPA Framework Practices
@tghosth is already working on this.
Since Aug 5, 2025.
- Dominant language
- HTML
- Stars
- 3.6k
- Forks
- 831
- Avg merge
- 7h 55m
- Merged PRs (30d)
- 4
Description
Verify that content intended to be displayed as text, rather than rendered as
HTML, is handled using safe rendering functions (such as createTextNode or
textContent) to prevent unintended execution of content such as HTML or
JavaScript.
In Single Page Application frameworks like react, vue, angular, using textContent or createTextNode manually is uncommon and unnecessary unless doing manual DOM manipulation. These API violates the declarative nature of Modern SPA frameworks, where rendering is handled through templating systems or virtual DOM abstractions. Forcing to use textContent discourages declarative UI and reusable components, and unnecessary complexity. Modern SPA frameworks automatically escape untrusted data during rendering by default, safe rendering is already inherently addressed.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.