4 ms·
> You could argue that the API is bad for allowing HTML strings as arguments That is exactly what I’m arguing, yes. > but it's not really surprising that a fu
by minitech 11y ago
> You could argue that the API is bad for allowing HTML strings as arguments
That is exactly what I’m arguing, yes.
> but it's not really surprising that a function does what it is documented to do
It doesn’t have to be surprising or undocumented to be stupid.
- rimantas 11y ago> You could argue that the API is bad for allowing HTML strings as arguments That is exactly what I’m arguing, yes. And how native DOM helps there?
- masklinn 11y agoThere are relatively few DOM APIs which take a trusted string. innerHTML and outerHTML are two and clearly state that they take HTML so it's no surprise for the stuff you give them to be interpreted thus. But if you use e.g. textContent or createTextNode to insert text into your document, they will correctly sanitise it. jQuery has text()[0], but because most of its API takes strings to start with, it's very convenient to do the wrong thing and shove untrusted strings into unsafe methods. [0] http://api.jquery.com/text/#text2 http://api.jquery.com/text/#text2
- rimantas 11y agoyes, API takes strings, but it calls native DOM at the end anyway, so I still don't get what's your point.
- masklinn 11y ago> yes, API takes strings, but it calls native DOM at the end anyway jQuery calls unsafe API which should only be handled trusted strings but makes it easy and convenient to give them untrusted string and thus introduce exploit vectors. Furthermore it's also significantly more difficult to audit the code, using the regular DOM there are only a pair of attributes to check, whereas pretty much any jQuery method call is a potential security hole. tldr: jQuery makes doing things wrong very easy, much easier than doing things right.