Metastatic.Analysis.BusinessLogic.InlineJavascript (Metastatic v0.10.4)

Detects inline executable code in templates/strings (XSS/injection risk).

Universal pattern: embedding code directly in strings/templates without sanitization.

Examples

Python (Django template with unsafe JS):

html = f'<script>var userId = {user_id};</script>'  # XSS risk - unescaped data

JavaScript (React with dangerouslySetInnerHTML):

return <div dangerouslySetInnerHTML={{__html: userContent}} />;  # XSS vulnerability

Elixir (Phoenix template with raw JS):

~H"""
<script>
  window.userId = <%= @user_id %>;  # Should use Phoenix.HTML.Tag or json encode
</script>
"""

C# (ASP.NET with Html.Raw):

@Html.Raw($"<script>var userId = {userId};</script>")  # XSS risk

Go (template with unescaped JS):

tmpl := template.Must(template.New("page").Parse(
    `<script>var userId = {{.UserID}};</script>`  # Should use JS escaping
))

Java (JSP with script tag):

out.println("<script>var userId = " + userId + ";</script>");  # XSS vulnerability

Ruby (Rails with javascript_tag):

javascript_tag "var userId = " + user_id.to_s  # Should use escape_javascript

PHP (inline script without escaping):

echo "<script>var userId = $userId;</script>";  # XSS risk - use htmlspecialchars