DeepFrontend
Learning Paths
Practice
System Design & DS
Design Studio
Data Structures Curriculum
Real-World Case Studies
Careers
Job Board
Resume Builder
Blog
Sign in
Search
⌘K
Go Pro
Loading compiler resources...
Web Security Quiz Practice
Active Recall Drill Session
← Exit Session
Question 1 of 1
medium
Web Security
A code review finds `el.innerHTML = location.hash.slice(1)` with no server round-trip involved. What should the reviewer flag?
A
Nothing — the server never sees this so it's safe
B
DOM-based XSS — location.hash is attacker-controllable via a crafted URL fragment and flows directly into a dangerous sink
C
This can only be a performance issue, not security
D
location.hash cannot contain HTML characters
Check Answer