3 ms·
It's not even incorrect. The option isn't supposed to allow XSS-by-design (which the original requester was worried about), the possibility of a vulnerability
by tgsovlerkhgsel 2y ago
It's not even incorrect.
The option isn't supposed to allow XSS-by-design (which the original requester was worried about), the possibility of a vulnerability is mentioned, the impact of a vulnerability is correctly described (XSS not RCE or similar), and mitigations that would effectively limit the impact of such a vulnerability are presented (separate origin).