|
|
|
|
|
|
by rezonant
1046 days ago
|
|
|
> and it is properly validated before insertion into your DB, such data poses no risk to your front end in terms of XSS This is making a lot of assumptions. Just because the data was acceptable in a database table does not mean it doesn't pose an XSS risk. Bear in mind, in other branches of this discussion we're talking about using DOM text APIs to insert. Certainly that is a good, reliable way to avoid XSS, but you can consider that to be value sanitization just done for you by the browser. In the absence of that, advocating that "if it comes from the API it is safe" is a dangerous thing to advocate for. The title "A world where <HTML> tag is not required for your web pages" might be perfectly valid to submit into your blog's CMS system, but that in no way means you can skip processing that in the frontend because "it is safe". Plenty of what you are saying is reasonable, but I think the topic requires a little more nuance in order to speak about the topic responsibly. |
|
|