document.write — DOM-based XSS surface

What it detects

document.write — DOM-based XSS surface: a xss check run by the textscan analyzer.

Evidence

The matching source path, line, and bounded code observation produced by the native rule.

Remediation

document.write() is XSS-prone and blocks the parser. Build DOM nodes via createElement/textContent, or use template literals + a sanitiser.

Limitations

This check is limited to the applicability and evidence delivered by textscan. Review the evidence in context; a match is a finding input, while confidence and policy determine its disposition.

Related reference

Analyzer Registry · Findings and release decisions · Policy and confidence

Remediation guidance: Remediation and fix verification · Baselines and suppressions