Update semgrep.test.js

Co-authored-by: semgrep-code-dotcms-test[bot] <183154938+semgrep-code-dotcms-test[bot]@users.noreply.github.com>
dotCMS · Oct 18, 2024 · 27d5622 · 27d5622
1 parent 3504596
commit 27d5622
Showing 1 changed file with 10 additions and 1 deletion.
diff --git a/semgrep.test.js b/semgrep.test.js
@@ -13,7 +13,16 @@ function bad2(userInput) {
 function bad3(userInput) {
   const name = '<div>' + userInput + '</div>';
 // ruleid: insecure-document-method
-  document.write(name);
+  // Import DOMPurify to sanitize user input
+  const DOMPurify = require('dompurify');
+
+  function bad3(userInput) {
+    // Sanitize the user input to prevent XSS
+    const sanitizedInput = DOMPurify.sanitize('<div>' + userInput + '</div>');
+
+    // Use document.write with sanitized input
+    document.write(sanitizedInput);
+  }
 }
 
 function ok1() {