2 ms·
This sounds potentially useful, but I'm not sure about the practicality. It's usually pretty easy to not write XSS vulnerabilities, as long as you know they ar
by jstanley 4y ago
This sounds potentially useful, but I'm not sure about the practicality.
It's usually pretty easy to not write XSS vulnerabilities, as long as you know they are a thing you need to think about.
Given that people don't bother to avoid writing XSS bugs right now, why do you think they will bother to use your tool to avoid writing XSS bugs in the future?
- bugmen0t 4y agoGiven the new DOM API, it’s also relatively easy to forbid the "bad APIs" using something like eslint (at the source level) or Trusted Types (at runtime). The hope is to also cater to frontend frameworks enough that they will adopt it. There are already some conversations.