xss-scan

Angular XSS Vulnerability Scan

Target path: $ARGUMENTS (default: src/).

Step 1: Scan for dangerous patterns

Run grep searches for each severity category against *.ts and *.html files in the target path.

CRITICAL

# Script injection bypass
grep -rnE 'bypassSecurityTrustScript\(' $ARGUMENTS --include='*.ts'
# URL injection bypass (may enable javascript: URIs)
grep -rnE 'bypassSecurityTrustUrl\(' $ARGUMENTS --include='*.ts'

HIGH

# HTML injection bypass
grep -rnE 'bypassSecurityTrustHtml\(' $ARGUMENTS --include='*.ts'
# Direct DOM manipulation bypassing Angular sanitizer
grep -rnE 'ElementRef.*nativeElement.*innerHTML' $ARGUMENTS --include='*.ts'
# Direct innerHTML assignment in component code
grep -rnE 'document\..*\.innerHTML\s*=' $ARGUMENTS --include='*.ts'
# Template innerHTML binding
grep -rnE '\[innerHTML\]=' $ARGUMENTS --include='*.html'

MEDIUM

# nativeElement innerHTML in any context
grep -rnE 'nativeElement\.innerHTML' $ARGUMENTS --include='*.ts'
# bypassSecurityTrustResourceUrl (less severe but still risky)
grep -rnE 'bypassSecurityTrustResourceUrl\(' $ARGUMENTS --include='*.ts'

Step 2: Report each finding

For every match, output in this format:

SEVERITY: [CRITICAL/HIGH/MEDIUM]
File: [path:line]
Pattern: [the detected code snippet]
Risk: XSS via unsanitized user input reaching DOM
Fix: [specific Angular-idiomatic fix from the table below]

Secure alternatives

Vulnerable Pattern	Fix
bypassSecurityTrustHtml(val)	Call DomSanitizer.sanitize(SecurityContext.HTML, val) first, then bypass only if needed
[innerHTML]="var"	Use [textContent]="var" for plain text; for HTML, pipe through DomSanitizer
nativeElement.innerHTML = x	Use Renderer2.setProperty(el, 'innerHTML', sanitized) instead
bypassSecurityTrustScript(x)	Remove entirely -- load scripts via Angular-approved methods only
bypassSecurityTrustUrl(x)	Validate URL scheme is http:/https: before bypass; reject javascript:
Any HTML rendering	Add DOMPurify.sanitize(input) as secondary defense before rendering