3 ms·
Would be nice if sanitizer output was a "known safe" type instead of plain string. With only strings, your API has no way of knowing if a string is safe (was a
by tantalor 6y ago
Would be nice if sanitizer output was a "known safe" type instead of plain string.
With only strings, your API has no way of knowing if a string is safe (was already sanitized) or not.
For example, goog.html.SafeHtml
https://google.github.io/closure-library/api/goog.html.SafeHtml.html https://google.github.io/closure-library/api/goog.html.SafeH...
- Cthulhu_ 6y ago> The other method available is the Sanitizer.sanitize() method. Which is very similar to above, however returns a DocumentFragment with disallowed script and blink elements removed.
- mhoad 6y agoI wonder how this could work along side the trusted types api.
- megous 6y agoYou can also disable all unsafe APIs, which is workable if you don't have to integrate third party code into your frontend. Then you don't have to mark anything as safe/unsafe, because it doesn't matter.
- slver 6y agoThere's honestly no such thing as "safe HTML". It's all very contextual. It can be safe in one context and unsafe in another. So trying to type it is futile. I've seen similar attempts with "taint flags" and what not. They fall very short in practice.