Back to all reviewers

Prevent injection vulnerabilities

continuedev/continue
Based on 1 comments
Typescript

When constructing templates or dynamic content that will be parsed, always implement robust escaping mechanisms to prevent injection vulnerabilities. Avoid using delimiters in template strings that might appear in the content itself, as this could break formatting or enable code injection attacks.

Security Typescript

Reviewer Prompt

When constructing templates or dynamic content that will be parsed, always implement robust escaping mechanisms to prevent injection vulnerabilities. Avoid using delimiters in template strings that might appear in the content itself, as this could break formatting or enable code injection attacks.

For example, instead of:

const template = "```}\n}```";

Consider using:

  1. Custom delimiters unlikely to appear in content
  2. Proper escaping functions for user-provided content
  3. Template libraries with built-in sanitization

This practice is critical for preventing cross-site scripting (XSS), SQL injection, command injection, and other security vulnerabilities that occur when user input is improperly handled in templates or dynamic content.

1
Comments Analyzed
Typescript
Primary Language
Security
Category

Source Discussions