Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Yes, but you can also easily lint on it: all uses of `context.innerHTML` are now suspect and should get a suggestion to use `context.setHTML` instead.

With `const clean = DOMPurify.sanitize(input); context.innerHTML = clean;` your linter suddenly needs to do complex code analysis and keep track if each variable passed to `context.innerHTML` is clean or tainted.



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: