3 ms·
Why on earth does the HTML sanitiser allow blacklisting?! That can't ever be safe to use, the set of HTML elements can always change.
by TazeTSchnitzel 8mo ago
Why on earth does the HTML sanitiser allow blacklisting?! That can't ever be safe to use, the set of HTML elements can always change.
- geocar 8mo agoI mean, at least they eventually came to their senses, but it does not inspire confidence! https://developer.chrome.com/blog/sanitizer-api-deprecation/ https://developer.chrome.com/blog/sanitizer-api-deprecation/
- Ndymium 8mo agoThat's the old sanitizer API. That was already removed and what you linked earlier is the new sanitizer API.
- Ndymium 8mo agoNote that the API is split into XSS-safe and XSS-unsafe calls. The XSS-safe calls [0] have this noted for each of them (emphasis mine): > Then drop any elements and attributes that are not allowed by the sanitizer configuration, and any that are considered XSS-unsafe (even if allowed by the configuration) The XSS-unsafe functions are all named "unsafe". Although considering web programmers, maybe they should have been named "UnsafeDoNotUseOrYouWillBeFired". [0] https://developer.mozilla.org/en-US/docs/Web/API/HTML_Sanitizer_API#xss-safe_methods https://developer.mozilla.org/en-US/docs/Web/API/HTML_Saniti...