Full disclosure: I inherited the code. I was tasked to fix it. After 9 hours, I am turning to you, the hive mind.

Inside an object (response) is response.Object Object contains HTML code.

$("doodah").html(response.Object)

Coverity doesn't like this. It's vulnerable to a DOM XSS attack. Coverity is complaining about how it is vulnerable to an arbitrary JavaScript statement that can taint respose.Object.

So I tried to REGEX it out. No good. .replace(RegEx_Clear_Scipt_Tags) didn't work. I added RegEx to clear Script tags and in-line JavaScript. Coverity does not like this either.

Fine, so I tried a function that puts the code in a DIV, strips out the Script tags through DOM functions and returns the innerHTML

No good. Coverity didn't like that either.

Does anyone have any suggestions?