Files
bitvid/decisions/DECISIONS_2026-02-20_innerhtml.md
T
google-labs-jules[bot]andPR0M3TH3AN f9f23c0d08 [security] replace innerHTML usages in js/ui/components/ShareNostrModal.js — convert to safe DOM APIs
- Replace template `innerHTML` with `DOMParser`
- Replace SVG `innerHTML` with `createElementNS`
- Replace `innerHTML = ""` with `replaceChildren()`
- Update `check-innerhtml` baseline

Co-authored-by: PR0M3TH3AN <[email protected]>
2026-02-20 20:07:34 +00:00

1.3 KiB

Decisions: innerHTML Migration for ShareNostrModal.js

1. Template Loading (L107)

Original: wrapper.innerHTML = html; New:

const parser = new DOMParser();
const doc = parser.parseFromString(html, "text/html");
wrapper.replaceChildren(...doc.body.childNodes);

Rationale: Avoids innerHTML while parsing the fetched HTML string safely.

2. Clearing Content (L274)

Original: this.relayPills.innerHTML = ""; New: this.relayPills.replaceChildren(); Rationale: Modern, faster, and safer method to clear DOM nodes.

3. SVG Icon (L300)

Original: removeButton.innerHTML = '<svg ...>...</svg>'; New:

const svg = document.createElementNS("http://www.w3.org/2000/svg", "svg");
svg.setAttribute("class", "h-3 w-3");
svg.setAttribute("viewBox", "0 0 24 24");
svg.setAttribute("fill", "none");
svg.setAttribute("stroke", "currentColor");
svg.setAttribute("stroke-width", "2");

const path = document.createElementNS("http://www.w3.org/2000/svg", "path");
path.setAttribute("d", "M18 6L6 18M6 6l12 12");
path.setAttribute("stroke-linecap", "round");
path.setAttribute("stroke-linejoin", "round");

svg.appendChild(path);
removeButton.appendChild(svg);

Rationale: Using createElementNS is the correct way to build SVG elements without innerHTML.