What causes "onerror handler detected (XSS risk)" in davila7/claude-code-templates?

Remove literal 'onerror=' from examples; describe the payload in prose or escape it ('onerror=')

SEM_E018

SEM_E018

Error message

onerror handler detected (XSS risk)

What it means

SEM_E018 is emitted by checkHtmlInjection when the content contains 'onerror=' (case-insensitive substring). onerror is a favorite XSS vector (e.g. <img src=x onerror=alert(1)>), so any occurrence in component markdown is reported.

Source

Thrown at cli-tool/src/validation/validators/SemanticValidator.js:290

          path,
          severity,
          matches: contexts.length,
          examples: contexts.slice(0, 3)
        });
      }
    }
  }

  /**
   * Check for HTML/Script injection attempts
   */
  checkHtmlInjection(content, path) {
    const dangerousTags = [
      { tag: '<script', code: 'SEM_E014', message: '<script> tag detected (XSS risk)' },
      { tag: '<iframe', code: 'SEM_E015', message: '<iframe> tag detected (injection risk)' },
      { tag: 'javascript:', code: 'SEM_E016', message: 'javascript: protocol detected (XSS risk)' },
      { tag: 'onclick=', code: 'SEM_E017', message: 'Inline event handler detected (XSS risk)' },
      { tag: 'onerror=', code: 'SEM_E018', message: 'onerror handler detected (XSS risk)' }
    ];

    for (const { tag, code, message } of dangerousTags) {
      const lowerContent = content.toLowerCase();
      if (lowerContent.includes(tag.toLowerCase())) {
        const index = lowerContent.indexOf(tag.toLowerCase());
        const lineInfo = this.getLineFromIndex(content, index);

        this.addError(code, message, {
          path,
          severity: 'critical',
          line: lineInfo.line,
          column: lineInfo.column,
          position: lineInfo.position,
          lineText: lineInfo.lineText,
          context: this.getContext(content, index, 50)
        });
      }

View on GitHub (pinned to a0851ed10c)

Solutions

Remove literal 'onerror=' from examples; describe the payload in prose or escape it ('onerror=')
For React onError props, restructure the example (destructure props or rename) so the exact substring 'onerror=' doesn't appear — remember matching is case-insensitive
For image error handling, show addEventListener('error', ...) in a script file

Example fix

# before
<img src=x onerror=alert(1)>
# after
The classic payload embeds an onerror handler in an img tag (escaped here).

Defensive patterns

Strategy: validation

Validate before calling

if (component.content.toLowerCase().includes('onerror=')) {
  // escape or describe the payload instead
}

Prevention

Don't paste onerror payloads verbatim in security docs
Use addEventListener('error', ...) in examples
Escape HTML attribute examples

When it happens

Trigger: validate() where content.toLowerCase().includes('onerror='). Substring-based, so it fires on XSS payload examples in docs, React onError={...} props (after lowercasing), and copy-pasted HTML snippets alike.

Common situations: Security-explainer components that show the classic <img src=x onerror=...> payload; image-handling examples using an onError callback; HTML reference tables listing event attributes.

Related errors

AI-assisted analysis of davila7/claude-code-templates@a0851ed10c (2026-08-28). Data as JSON: /api/errors/a6c42e8f6726512b. Report an issue: GitHub.