3 ms·
These are meant to be run through the DOMPurify library which serializes back to a different DOM tree than the input, so the input is not expected to work strai
by triyambakam 6y ago
These are meant to be run through the DOMPurify library which serializes back to a different DOM tree than the input, so the input is not expected to work straight away
- sergeykish 6y agoYes, that's what it does. Check Firefox. First (unescaped) sample was my sanity check, yes, it alerts from <iframe>. It work in Chrome on div.innerHTML = sanitized but not on iframe.srcdoc = sanitized iframe.src = `data:text/html;charset=UTF-8,${sanitized}` I am rewriting document so it is possible to check different methods.