Mention other popular frameworks' unsafe functions. (#1391)

OWASP · Apr 23, 2024 · d2e62ac · d2e62ac
1 parent d647705
commit d2e62ac
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.md b/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.md
@@ -16,6 +16,8 @@ Fortunately, applications built with modern web frameworks have fewer XSS bugs,
 - React’s `dangerouslySetInnerHTML` without sanitising the HTML
 - React cannot handle `javascript:` or `data:` URLs without specialized validation
 - Angular’s `bypassSecurityTrustAs*` functions
+- Lit's `unsafeHTML` function
+- Polymer's `inner-h-t-m-l` attribute and `htmlLiteral` function
 - Template injection
 - Out of date framework plugins or components
 - and more