JS: make sanitization a "common" technique rather than "important"#4141
Conversation
|
You could put the That would require a bit more rewriting, but I think it could be good to present the safest option first. |
I think the order is fine. We are generally recommending local fixes for the alerts we produce, not architectural rewrites. Ping @mchammer01 for a minor doc review |
| <p> | ||
|
|
||
| An even safer alternative is to design the application | ||
| such that sanitization isn't needed at all, for instance by using HTML |
There was a problem hiding this comment.
I'll leave it up to the documentation team to decide whether it's preferable to say "isn't" or "is not".
felicitymay
left a comment
There was a problem hiding this comment.
Thanks for making the help more precise and helpful to users. I've made one suggestion several times, but otherwise the changes LGTM once the tests pass.
Co-authored-by: Felicity Chapman <felicitymay@github.com>
|
Thank you all. I have applied @felicitymay's suggestions, and just need a final approval. |
|
@esbena - thanks for the ping and sorry for not responding (I was away yesterday.) |
It was pointed out that sanitization is bordering on being an anti-pattern, and that we should make it clearer in our documentation that better alternatives exist.
I have therefore changed the "sanitization is important" formulations to "sanitization is common", and added an example of an alternative where appropriate.