Scratchaddons: We will reject addons using innerHTML or triple curly from now on

[apple502j]

Please do not use innerHTML. Use appendChild or textContent or innerText. Existing addons will be changed to use these methods. This includes Vue {{{.

[YOYITsM3M8]

Kkkkkk I always use appendChild bc innerHTML doesn’t work for me sometimes. innerHTML is easier tho

[jeffalo]

[Explosion-Scratch]

This is gonna sound stupid, but… What is innerhtml?

[jeffalo]

This is gonna sound stupid, but… What is innerhtml?

in javascript there are many ways to interact with the html page. one of them is directly modifying the HTML which is bad because it opens up for attacks like XSS and stuff.

[Explosion-Scratch]

Oh, I see. Thanks! :)

[WorldLanguages]

The issue isn't innerHTML itself really (even tho it's dangerous if you don't know what you're doing), but the review process in extension stores. They don't like innerHTML.

[Hans5958]

I don't think you can say that all innerHTML implementation is bad. Sure that "innerHTML is bad because it parses it directly so they can XSS", but I don't think that's the case here.

But, sure, using textContent is feasable.

[tb148]

Maybe add an "announcement" label for this type of issues?

[Hans5958]

Pins are enough, perhaps?

[tb148]

Pins are enough, perhaps?

We only have limited numbers (to be more specific, 3) of pins. So accessing older ones is hard without an unique label.

[apple502j]

Vue.js {{{ is now on the denylist. If you really need to use it, please ask me. The only allowed usage for now is for comments (because they are sanitized server side).

[tb148]

What is Vue {{{?

[apple502j]

Works same as innerHTML.

[YOYITsM3M8]

what about innerText

[apple502j]

innerText is safe.

[YOYITsM3M8]

K

[NoobTracker]

Question, @apple502j: What about insertAdjacentHTML()?

[apple502j]

@NoobTracker As long as you can add HTML, don't.

[BoomerScratch]

Will an addon with this get rejected?

element.innerHTML = string.replace(/</g,"&lt;").replace(/>/g,"&gt;");

[NoobTracker]

@apple502j I think that it's used somewhere in an extension ... but don't ask me which one.

[tb148]

@apple502j I think that it's used somewhere in an extension ... but don't ask me which one.

Just search it in this repo and you will find.

[NoobTracker]

Well I dunno how to do that.
I think @JeffaloBob did it ...

[easrng]

Will an addon with this get rejected?

element.innerHTML = string.replace(/</g,"&lt;").replace(/>/g,"&gt;");

Why not just use textContent? Easier to avoid XSS.

[BoomerScratch]

@easrng But what if you want, for example, this?

element.innerHTML = string.replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/\n/g,"<br>");

[NoobTracker]

Well @BoomerScratch it seems like the reason why this isn't allowed anymore is that the addon people don't like it, although it might be used in completely harmless situations.

[easrng]

@easrng But what if you want, for example, this?

element.innerHTML = string.replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/\n/g,"<br>");

Use textcontent and white-space: pre-line;

[Explosion-Scratch]

It seems like everyone is on the same page about this now so I'll close it.