Pretty much. Interestingly it is a very similar approach to Perl's "taint mode". The intention is obviously that you can't blindly use/output values that are

Pretty much. Interestingly it is a very similar approach to Perl's "taint mode". The intention is obviously that you can't blindly use/output values that are user-provided. Instead you must validate, and convert them to a "trusted type", at which point you can use them in your DOM tree, or wherever you wish. The big difference is that if you forget a place here you'll get a type error - rather than the current situation where if you forget to validate/sanitize you get an XSS attack.