4 ms·
yes, API takes strings, but it calls native DOM at the end anyway, so I still don't get what's your point.
by rimantas 11y ago
yes, API takes strings, but it calls native DOM at the end anyway, so I still don't get what's your point.
- masklinn 11y ago> yes, API takes strings, but it calls native DOM at the end anyway jQuery calls unsafe API which should only be handled trusted strings but makes it easy and convenient to give them untrusted string and thus introduce exploit vectors. Furthermore it's also significantly more difficult to audit the code, using the regular DOM there are only a pair of attributes to check, whereas pretty much any jQuery method call is a potential security hole. tldr: jQuery makes doing things wrong very easy, much easier than doing things right.