Code QuizIntermediate

DOM-based XSS from unsafe sink assignment (innerHTML, document.write)

Assigning untrusted URL data directly to innerHTML creates a DOM-based XSS vulnerability.

Codejavascript

const params = new URLSearchParams(window.location.search);
const name = params.get('name');

const greeting = document.getElementById('greeting');
greeting.innerHTML = 'Welcome, ' + name + '!';

What is the security bug in this code?

Next →Content Security Policy (CSP) directives and configuration