#2468 no innerHTML and document.write

[elarlang]

This Pull Request relates to issue #2468

[randomstuff]

[ADDED, SPLIT FROM 5.3.3] Verify that untrusted input must not be applied via innerHTML, document.write, or other properties or functions that render HTML. Instead, use createTextNode, textContent, and similar safe functions that do not render HTML and only render content as text.

What about when the user enters markdown or HTML (which is then filtered using some library). Does "filtered user input" count as "untrusted input"?

I would consider it is not allowed by this wording requirement but should be allowed. Should we add some provision for when the input has been properly filtered?

[elarlang]

[ADDED, SPLIT FROM 5.3.3] Verify that untrusted input must not be applied via innerHTML, document.write, or other properties or functions that render HTML. Instead, use createTextNode, textContent, and similar safe functions that do not render HTML and only render content as text.

What about when the user enters markdown or HTML (which is then filtered using some library). Does "filtered user input" count as "untrusted input"?

I would consider it is not allowed by this wording requirement but should be allowed. Should we add some provision for when the input has been properly filtered?

This is discussion about sanitization. See my comment here: #2468 (comment)

[elarlang]

@randomstuff - I merged the PR, if you have further some concerns or proposals, please write those to related issue and then we can re-open it (if needed)