csti-scan

Paste an ERB or HTML view. It flags lines where a server-rendered value lands inside a client-side template binding in Vue or Angular, the spot where HTML escaping stops protecting you and a reflected value turns into runnable code.

Runs entirely in your browser.
Your code is never sent anywhere.

source · ERB / Vue / Angular template0 lines
problems0

What it flags

  • Server output inside a Vue binding: :attr="'<%= ... %>'" and v-bind:. Vue runs the value as a JS expression.
  • Server output in v-html, rendered as raw HTML.
  • Server output inside a Vue interpolation: {{ <%= ... %> }}.
  • Server output in an Angular [property] binding, including [innerHTML].
  • Bindings split across lines, not just single-line ones.

What it can't do

This is a heuristic, not a full parser. It reads only what you paste, so it won't follow a value through a helper, a partial, or a variable assigned earlier, and it doesn't cover Haml, Slim, or React. It can't confirm a real bug, only the dangerous shape.

Treat a clean result as "nothing obvious here", not "proven safe". For coverage across a codebase, use a static rule (Semgrep) or a DOM-driven scan. A standard Rails scanner like Brakeman won't catch this class at all.