2 ms·
> You can think of TrustedHTML as an interface indicating that a string has been somehow specially "blessed" as safe... Sanitized. Unfortunate naming. "Truste
by mrkeen 3y ago
> You can think of TrustedHTML as an interface indicating that a string has been somehow specially "blessed" as safe... Sanitized.
Unfortunate naming. "Trusted" is one of those words which has taken on its own opposite as a meaning. Like "redundant" or "cope".
This feature would be Checked/Validated/Trustworthy/Safe. Values would end up in this state if you did not trust them and needed to check them.
- semi-extrinsic 3y agoI recall many moons ago, I used OpenSuse in my local language, and "Untrusted" had been translated as though it meant "Untrustworthy". Hilarity ensued.
- sublinear 3y agoI agree "sanitized" is the only accurate term for this. I think the reason they bother using any other word is the assumption that some web developers aren't familiar with the term, or maybe to score points with pointy haired bosses that absolutely should not be working in the industry in 2024.
- semiquaver 3y agoBut it may not have been sanitized. It may be the output of a source that we trust not to be malicious (for example, a string generated by a server)
- sublinear 3y agoGood point. I didn't read that far and if you're right that's terrible even if it follows the same origin policy.
- Thorrez 3y agoWell, the string can be trusted to not have a working XSS attack, because it's been sanitized.
- dwheeler 3y agoLooks correct to me. You must specially mark data that is trusted as trusted. All other daya is not trusted.