3 ms·
Great point! It wanted to edit the comment to change (1) to (server/client) but I passed my edit timeout. I would include your (5) within (1). `textContent` a
by lucideer 6y ago
Great point!
It wanted to edit the comment to change (1) to (server/client) but I passed my edit timeout.
I would include your (5) within (1). `textContent` and other DOM methods like `setAttribute` are effectively secure output-escaping on the client.
Your (5a) is an excellent extra measure. In this area, I'd also add security-focused linting for (1) and (5)–e.g. for (5), to ensure secure DOM methods are used, I use Mozilla's `eslint-plugin-no-unsanitized`[0] plugin for all my personal & work projects.
[0] https://github.com/mozilla/eslint-plugin-no-unsanitized/ https://github.com/mozilla/eslint-plugin-no-unsanitized/