Security Test: HTML Injection¶

Description¶

Default Severity: high

HTML Injection occurs when an application takes user input and shows it on a webpage without properly checking or cleaning it first. This allows an attacker to insert unwanted HTML or JavaScript into the page, which could change its behavior, steal sensitive information, or hijack user sessions. The risk comes from assuming that any incoming data is safe, rather than validating or encoding it before display. If overlooked, this vulnerability can lead to further issues like XSS attacks, breaking the trust of users and compromising the site’s functionality.

Reference:

• https://owasp.org/www-community/attacks/HTML_Injection

Configuration¶

Identifier: frontend_injection/html_injection

Examples¶

All configuration available:

checks:
  frontend_injection/html_injection:
    skip: false # default

Compliance and Standards¶