Hacker News Reader

Comment by alcover | Hacker News Reader

  >  textContent = response

Good question (that none of the replies seem to address). That is exactly what I would do if rendering 'tainted' text.

Can someone please tell us how it could be defeated ?

View on HN

This should be safe.

...unless it is a text that the attacker shows to another user, in which case they can trick this user to perform some action (send cryptocurrency,...).

Reply on news.ycombinator.com