Post

Firefox for Web Developers

@webdevs.firefox.com

You can throw away innerHTML and replace it with the new setHTML(), which has a built-in sanitizer. Here's how it works:

25/2/26, 12:09 pm24 reposts155 likes

Michaël Vanderheyden

Can't wait to get rid of all the custom sanitzer functions. This is both a security improvement but mostly a improvement in DX ☺️

@orangetronic.bsky.social

😮

winfred jebasingh

@winfredjj.bsky.social

nice and simple explanation

Firefox for Web Developers

@webdevs.firefox.com

Here are the full docs developer.mozilla.org/en-US/docs/W...

developer.mozilla.orgHTML Sanitizer API - Web APIs | MDNThe HTML Sanitizer API allows developers to take strings of HTML and filter out unwanted elements, attributes, and other HTML entities when they are inserted into the DOM or a shadow DOM.

Any chance to polyfill or mock this?

Firefox for Web Developers

@webdevs.firefox.com

It feels doable, but I don't think there's one right now that conforms to the modern spec.