Goodbye InnerHTML, Hello SetHTML: Stronger XSS Protection in Firefox 148 (hacks.mozilla.org)

Article summary

Firefox 148 introduces the Sanitizer API, a standardized way to sanitize untrusted HTML before inserting it into the DOM, providing stronger protection against cross-site scripting (XSS) attacks. The setHTML method integrates sanitization directly into HTML insertion, allowing developers to replace error-prone innerHTML assignments with a safer alternative. This new API aims to fill the gap in XSS protection, especially for existing websites that may not have adopted Content Security Policy (CSP). The Sanitizer API can be combined with Trusted Types for even stronger protections.

Main themes

• XSS protection
• Sanitizer API
• HTML sanitization
• Browser security
• Web development
• Legacy code

What commenters say

• The introduction of the Sanitizer API may lead to a mix of safe and unsafe methods, making it unclear which is which, and potentially causing confusion among developers.
• Replacing innerHTML with setHTML can be a straightforward way to improve security, but it may not be feasible for all existing codebases.
• Some argue that AI-powered tools can help with refactoring and replacing deprecated code, but others are skeptical about their ability to do so accurately and safely.
• The use of deprecated code, such as innerHTML, is still prevalent, and some developers may not see the need to upgrade to newer, safer alternatives.
• Marking certain methods as 'unsafe' can provide a clear indication of potential risks, but it may also create a false sense of security if not all unsafe methods are labeled as such.
• The default behavior of APIs and languages should prioritize safety, with unsafe or unexpected behaviors requiring explicit indication or exception handling.
• The evolution of JavaScript has led to the deprecation of certain features, such as 'var', but their use may still be present in existing codebases, and their replacement may not be straightforward.