hard20 pts · first answer countsweb-securityxss

Preventing XSS from user HTML

Your app must show rich-text comments written by users as HTML. Which approach is safest?

A.Set innerHTML after removing <script> tags with a regexB.Escape the HTML on the client with encodeURIComponent and render itC.Store the HTML in localStorage before rendering itD.Sanitise with a well-tested allow-list library like DOMPurify, and add a strict Content Security Policy

Discussion 0

Join free to post in the discussion.

Preventing XSS from user HTML

Discussion 0

Related questions