What's incredible is that the author actually had to modify an XSS test so that it read: > const expected: string = "Hello<br><script>alert('evil');</script>Wo

What's incredible is that the author actually had to modify an XSS test so that it read: > const expected: string = "Hello<br><script>alert('evil');</script>World!"; (Meaning they actually changed a line that had "<script>alert('evil')</script>" and didn't notice.) I have seen this before though, with some folks removing path sanitisation code I added several years prior to fix a CVE. So it's not uncommon (it also got merged, so when I found out and fixed it I added a very large and scary comment to stop people from doing it again).