Files
bitvid/decisions/DECISIONS_2026-02-20_innerhtml.md
T
google-labs-jules[bot]andPR0M3TH3AN f9f23c0d08 [security] replace innerHTML usages in js/ui/components/ShareNostrModal.js — convert to safe DOM APIs
- Replace template `innerHTML` with `DOMParser`
- Replace SVG `innerHTML` with `createElementNS`
- Replace `innerHTML = ""` with `replaceChildren()`
- Update `check-innerhtml` baseline

Co-authored-by: PR0M3TH3AN <[email protected]>
2026-02-20 20:07:34 +00:00

38 lines
1.3 KiB
Markdown

# Decisions: innerHTML Migration for ShareNostrModal.js
## 1. Template Loading (L107)
**Original:** `wrapper.innerHTML = html;`
**New:**
```javascript
const parser = new DOMParser();
const doc = parser.parseFromString(html, "text/html");
wrapper.replaceChildren(...doc.body.childNodes);
```
**Rationale:** Avoids innerHTML while parsing the fetched HTML string safely.
## 2. Clearing Content (L274)
**Original:** `this.relayPills.innerHTML = "";`
**New:** `this.relayPills.replaceChildren();`
**Rationale:** Modern, faster, and safer method to clear DOM nodes.
## 3. SVG Icon (L300)
**Original:** `removeButton.innerHTML = '<svg ...>...</svg>';`
**New:**
```javascript
const svg = document.createElementNS("http://www.w3.org/2000/svg", "svg");
svg.setAttribute("class", "h-3 w-3");
svg.setAttribute("viewBox", "0 0 24 24");
svg.setAttribute("fill", "none");
svg.setAttribute("stroke", "currentColor");
svg.setAttribute("stroke-width", "2");
const path = document.createElementNS("http://www.w3.org/2000/svg", "path");
path.setAttribute("d", "M18 6L6 18M6 6l12 12");
path.setAttribute("stroke-linecap", "round");
path.setAttribute("stroke-linejoin", "round");
svg.appendChild(path);
removeButton.appendChild(svg);
```
**Rationale:** Using `createElementNS` is the correct way to build SVG elements without `innerHTML`.