Code RoomHTML sanitizer output re-parsed

HardPrep Room Coding #2076

HTML sanitizer output re-parsed

Code reviewSecuritySenior–Staff~22 min

Review this JavaScript rich-text renderer that sanitizes, then re-parses the HTML.

What a strong answer looks like

Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix, specific and kind.

0:00 of about 22 min

Mark a line and say what kind of problem it is.0 findings

1import DOMPurify from 'dompurify';

2

3function render(container, userHtml) {

4 const clean = DOMPurify.sanitize(userHtml);

5 // 'Normalize' the markup by round-tripping through a template element

6 const tpl = document.createElement('template');

7 tpl.innerHTML = clean;

8 const normalized = tpl.innerHTML;

9 container.innerHTML = normalized;

10}

Which questions mattered is sealed until you submit. Telling you now would just be handing over the edge cases.