SH005: dangerouslySetInnerHTML without sanitizer

Severity: medium · Category: security · Applies to: nextjs, react

Why it matters

Rendering raw HTML bypasses React's escaping. If any part comes from a user, it becomes a cross-site scripting hole.

How to fix

Sanitize the HTML with DOMPurify before rendering, or render text instead.

Ignoring this rule

Skip it everywhere in devshield.yml:

ignore:
  - SH005

Or skip one line with a comment on that line or the line above:

devshield-ignore: SH005