2 ms·
Is “XSS-unsafe” precisely defined anywhere? I assume it means “any access to the JS interpreter”, but assuming in this context seems decidedly unsafe.
by CGamesPlay 1y ago
Is “XSS-unsafe” precisely defined anywhere? I assume it means “any access to the JS interpreter”, but assuming in this context seems decidedly unsafe.
- pyth0 1y agoIt appears you can tune what is sanitized from the input via the "sanitizer" optional parameter. The default sanitizer is however defined in a spec linked on the docs page [1] with the actual sanitize operation specified as well [2]. [1] https://wicg.github.io/sanitizer-api/#dom-element-sethtml https://wicg.github.io/sanitizer-api/#dom-element-sethtml [2] https://wicg.github.io/sanitizer-api/#sanitize https://wicg.github.io/sanitizer-api/#sanitize
- CGamesPlay 1y agoAh, perfect, the "remove unsafe" operation is what I was looking for. It includes a list of elements and a list of attributes. These appear to apply regardless of the sanitizer configuration you use, the original MDN link demonstrates allowlisting "script" but seeing that it is removed anyways. https://wicg.github.io/sanitizer-api/#sanitizerconfig-remove-unsafe https://wicg.github.io/sanitizer-api/#sanitizerconfig-remove...