3 ms·
This is absolutely unclear. If the user enters HTML and that HTML never gets to the server then why sanitize it? To protect user from hacking themselves?
by codedokode 5y ago
This is absolutely unclear. If the user enters HTML and that HTML never gets to the server then why sanitize it? To protect user from hacking themselves?
- oh_sigh 5y agoSure, why not? Most users expect that if they paste something into a textbox on a site, that their browser won't send their cookies and browsing history to some random 3rd party
- alanfranz 5y agoGoogle for "reflected XSS". Sometimes a parameter in the URL can be rendered in the user's browser.
- playpause 5y agoUsers may 'hack themselves' when an attacker persuades them to paste something into a website, for example. These are very basic XSS questions by the way, you don't seem to know enough about the subject to be this incredulous.
- dzaima 5y agoIn addition to the other replies, there could be server-provided HTML that the user has the option to change, and initiating a change, activating the vulnerability, could be one click. (this happened to Google's own search bar!) Then there are cases of different browsers parsing things differently and/or bad sanitization/serializing giving different results on repeated invocation or just being broken on the server-side. A simple client-side option is gonna be a lot simpler.