Post

rip bozo innerHTML

Firefox for Web Developers@webdevs.firefox.com

The Sanitizer API landed in Firefox 148, along with element.setHTML(). This lets you fully configure how HTML strings are cleaned as they're parsed. hacks.mozilla.org/2026/02/good...

hacks.mozilla.orgGoodbye innerHTML, Hello setHTML: Stronger XSS Protection in Firefox 148 – Mozilla Hacks - the Web developer blogCross-site scripting (XSS) remains one of the most prevalent vulnerabilities on the web. The new standardized Sanitizer API provides a straightforward way for web developers to sanitize untrusted…

24/2/26, 2:29 pm3 reposts61 likes

cinnamon 🐇 🏳️‍⚧️

@plushie.holdings

24 Feb

whoa setHTMLUnsafe(..) is already baseline

Banda Bassotti

@orpach.neocities.org

24 Feb

Yeah, you kinda want people to use that first rather than using setHTML and removing the sanitisation. Don't know if that was their reasoning, but makes sense to me.

Luke

@lukewarlow.dev

24 Feb

You can't remove the safety from setHTML fwiw. It will always enforce a baseline that prevents XSS. The default sanitizer just also removes a lot of other things. You can do setHTML("", {sanitizer: {}}) to get the absolute minimum safety. There's lots of flexibility in the API though.

Luke

@lukewarlow.dev

24 Feb

For when you *really* need to inject script dynamically via the parser you can use setHTMLUnsafe, which also takes a sanitizer in supporting browsers. So you essentially never need to use innerHTML once this is baseline.