Code reviewHardcr-g451

Subject XssLevel Senior–Staff~22 minCommon in Security interviewsIndustries Software development

Question

Review this JavaScript rich-text renderer that sanitizes, then re-parses the HTML.

What a strong answer looks like

Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix — specific and kind.

Learn the concepts

Talk through your review

Code to reviewjs

1import DOMPurify from 'dompurify';2 3function render(container, userHtml) {4  const clean = DOMPurify.sanitize(userHtml);5  // 'Normalize' the markup by round-tripping through a template element6  const tpl = document.createElement('template');7  tpl.innerHTML = clean;8  const normalized = tpl.innerHTML;9  container.innerHTML = normalized;10}

Run or narrate your approach, then ask the coach.