codeql/javascript/ql/test/query-tests/Security/CWE-079/UnsafeHtmlConstruction/lib2/index.ts

export function trivialXss(s: string) {
    const html = "<span>" + s + "</span>"; // NOT OK - this file is recognized as a main file.
    document.querySelector("#html").innerHTML = html;
}