XSS in search results renderer

Code reviewSecurityMid–Senior~20 min

Review this client-side search-results renderer.

What a strong answer looks like

Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix, specific and kind.

0:00 of about 20 min

Mark a line and say what kind of problem it is.0 findings

1function renderResults(query, items) {

2 const box = document.getElementById('results');

3 box.innerHTML = '<h3>Results for ' + query + '</h3>';

4 for (const it of items) {

5 box.innerHTML += `<div class="row">${it.title}</div>`;

6 }

8// query comes from location.search; items come from the API

Which questions mattered is sealed until you submit. Telling you now would just be handing over the edge cases.