4 ms·
because there are way, way more ways of getting XSS than innerHTML. if innerHTML was the only way to get XSS, XSS would have been solved by React / Angular. Con
by zemnmez 7y ago
because there are way, way more ways of getting XSS than innerHTML. if innerHTML was the only way to get XSS, XSS would have been solved by React / Angular. Consider <a href=xx/> – if xx is `javascript:alert(1)` it executes code, even if you generate this DOM node without even touching HTML.
- rubbingalcohol 7y agoContent Security Policy (which Trusted Types is taped on to) already provides for blocking unsafe-eval, which would prevent this type of attack. No need for vendor specific bloat.