Raw HTML Render Check — Can a Chat Message Run Script in Another User's Browser?
DevMeth checks the 48 known AI-code failure patterns — not a penetration test or a security guarantee.
What the issue is
User or AI content rendered as raw HTML is stored XSS: a planted message or profile field runs script in every other user's browser — session theft, silent data mutation.
Why AI tools generate it
AI chat UIs render model answers as markdown-turned-HTML; AI scaffolds wire dangerouslySetInnerHTML because it makes markdown work, and the sanitizer is the step tutorials skip.
How DevMeth detects it
A code scan flags raw-HTML sinks (dangerouslySetInnerHTML, innerHTML, {@html}, HTML-enabled markdown renderers) with no sanitizer in the file, and react-markdown rehype-raw setups. Static markup and sanitizer-protected paths are not flagged.
User or AI-generated content is rendered as raw HTML
WHAT WE FOUND
C38 — masked sample
The fix, in three steps
Add DOMPurify (or sanitize-html / rehype-sanitize) on each flagged path — or switch to react-markdown without rehype-raw, which escapes HTML by default.
Run a free scan and each finding carries a paste-ready fix prompt you can act on.
Try a free scanFAQ
Why is AI chat output dangerous to render?
The model repeats what users plant. A message containing an <img onerror=...> tag can come back rendered in another user's chat — the model is a confused deputy, not a trusted author.
I only render my own markup — why was I flagged?
The scan can't prove the content is static. If the flagged value is authored markup that never touches user or model input, note that in the fix PR — but audit the data flow first: most 'static' banners started static.
What's the fix?
DOMPurify on the client, sanitize-html on the server, or rehype-sanitize in markdown pipelines. Or drop raw HTML entirely — react-markdown without rehype-raw escapes by default.
DevMeth checks the 48 known AI-code failure patterns — not a penetration test or a security guarantee. A clear result means each known pattern was checked and found clear or not applicable for your app; it is not a guarantee of security.