Cross-site scripting (XSS) in Next.js
Render user text as text. If you need formatting, use a markdown renderer that does not pass raw HTML through, or sanitize with a maintained HTML sanitizer and a strict allowlist (no script , no event handlers, no javascript: URLs).
Fix for Next.js
Render user text as text. If you need formatting, use a markdown renderer that does not pass raw HTML through, or sanitize with a maintained HTML sanitizer and a strict allowlist (no script, no event handlers, no javascript: URLs). DOMPurify is a widely used sanitizer. Pin the version and keep it updated.
export function Bio({ bio }: { bio: string }) {
return <p>{bio}</p>;
}
For links, allow only https: after parsing the URL. Reject everything else.
Do not build a sanitizer with a regex. You will miss a browser quirk.
The five-minute check, the other platforms, and the agent prompt are on the full guide. More Next.js fixes are on the Next.js page.