4 ms·
Why should a web page only have a single person generating and injecting HTML into it?
by evbogue 1y ago
Why should a web page only have a single person generating and injecting HTML into it?
- intrasight 1y agoA single company. Why would I let another company inject HTML into my page?
- afavour 1y agoThere's this newfangled concept called social media where you let other people post content that exists on your web site. You're rarely allowed to post HTML because of the associated issues with sanitizing it. setHTML could help with that.
- president_zippy 1y agoI just had a flashback to the heyday of MySpace. Now that I think about it though, Neocities has the "social networking" of being able to discover other people's pages and give each other likes and comments. Hmmm...
- mpeg 1y agoOr CMS content, or even anything that comes from the user outside of social media content and could cause a reflected XSS for example, a search query, or a redirect url, or a million other things
- intrasight 1y agoThe analogy doesn't hold markup ;) Whether I generate a whole page or generate a partial page and then add HTML to it is equivalent from a safety perspective.