←back to thread

Element: setHTML() method

(developer.mozilla.org)
170 points todsacerdoti | 2 comments | | HN request time: 0.416s | source
Show context
modinfo ◴[] No.45676114[source]
Cursor build a pseudo-sethtml: https://github.com/skorotkiewicz/pseudo-sethtml
replies(1): >>45676607 #
exdeejay_ ◴[] No.45676607[source]
This code only does the most basic and naive regex filtering that even a beginner XSS course's inputs would work against. With the Node example code and input string:

  <p>Hello <scr<script>ipt>alert(1)</scr<script>ipt> World</p>
The program outputs:

  $ node .
  <p>Hello <script>alert(1)</script> World</p>
  {
    sanitizedHTML: '<p>Hello <script>alert(1)</script> World</p>',
    wasModified: true,
    removedElements: [],
    removedAttributes: []
  }
Asking a chatbot to make a security function and then posting it for others to use without even reviewing it is not only disrespectful, but dangerous and grossly negligent. Please take this down.
replies(1): >>45677975 #
1. codedokode ◴[] No.45677975[source]
I wonder why Cursor chose regex approach when it is widely known that it is a wrong method. Is it a result of training on low-quality forums for beginners?
replies(1): >>45678618 #
2. ◴[] No.45678618[source]