davila7/claude-code-templates · error

SEM_E016

SEM_E016

Error message

javascript: protocol detected (XSS risk)

What it means

SEM_E016 is emitted by checkHtmlInjection when the content (case-insensitively) contains the substring 'javascript:'. The javascript: URL scheme executes arbitrary JS when a link is followed, so any occurrence in component markdown is treated as an XSS risk.

Source

Thrown at cli-tool/src/validation/validators/SemanticValidator.js:288

        this.addError(code, message, {
          path,
          severity,
          matches: contexts.length,
          examples: contexts.slice(0, 3)
        });
      }
    }
  }

  /**
   * Check for HTML/Script injection attempts
   */
  checkHtmlInjection(content, path) {
    const dangerousTags = [
      { tag: '<script', code: 'SEM_E014', message: '<script> tag detected (XSS risk)' },
      { tag: '<iframe', code: 'SEM_E015', message: '<iframe> tag detected (injection risk)' },
      { tag: 'javascript:', code: 'SEM_E016', message: 'javascript: protocol detected (XSS risk)' },
      { tag: 'onclick=', code: 'SEM_E017', message: 'Inline event handler detected (XSS risk)' },
      { tag: 'onerror=', code: 'SEM_E018', message: 'onerror handler detected (XSS risk)' }
    ];

    for (const { tag, code, message } of dangerousTags) {
      const lowerContent = content.toLowerCase();
      if (lowerContent.includes(tag.toLowerCase())) {
        const index = lowerContent.indexOf(tag.toLowerCase());
        const lineInfo = this.getLineFromIndex(content, index);

        this.addError(code, message, {
          path,
          severity: 'critical',
          line: lineInfo.line,
          column: lineInfo.column,
          position: lineInfo.position,
          lineText: lineInfo.lineText,
          context: this.getContext(content, index, 50)

View on GitHub (pinned to a0851ed10c)

Solutions

1. Rephrase prose so 'JavaScript' is not immediately followed by a colon ('using JavaScript — features include...')
2. Remove javascript: links from markdown; use normal https:// links
3. Escape XSS payload examples inside code fences as 'java\x73cript:' or describe the payload in words

Example fix

# before
Learn about JavaScript: closures, promises, and more.
# before (link)
[x](javascript:alert(1))
# after
Learn about JavaScript — closures, promises, and more.
# after (link)
[x](https://example.com)

if (component.content.toLowerCase().includes('javascript:')) {
  // check prose 'JavaScript:' false positive or a javascript: URL to remove
}

When it happens

Trigger: validate() where content.toLowerCase().includes('javascript:'). Substring match: matches links like [x](javascript:alert(1)) but also prose such as 'written in JavaScript: a guide' or code examples calling 'javascript:' protocols.

Common situations: Docs that say 'using JavaScript: features include...' with a colon immediately after the word; example payloads demonstrating XSS; bookmarklet-style instructions.

Related errors

• SEM_E014
• SEM_E017
• SEM_E018
• SEM_W003
• SEM_W004

AI-assisted analysis of davila7/claude-code-templates@a0851ed10c (2026-08-28). Data as JSON: /api/errors/87fd7d73faf2ba7c. Report an issue: GitHub.