UNSAFE_HTML_SINK: HTML written from a string
| Severity | Fault | Stage |
|---|---|---|
| error | customer (the source package) | build output |
What it means
Section titled “What it means”The component writes as HTML (innerHTML, outerHTML, insertAdjacentHTML, srcdoc, setHTMLUnsafe, createContextualFragment or dangerouslySetInnerHTML) a string that is not a fixed literal, or a literal that runs script (a <script> element, an on… handler attribute, a javascript: URL). When the string comes from a prop, an attribute of the page or an API, markup such as <img onerror> in it runs script in the host page (rule html-sink).
How to fix
Section titled “How to fix”Render the content with JSX ({message} is escaped), or set textContent; for formatting, accept structured data (a list of paragraphs, bold ranges) instead of HTML.