GitHub

Grid.js formatter uses innerHTML by default, facilitating injection vulnerabilities

Grid.js lines 236 - 237: td.innerHTML = typeof formatter === 'string' && formatterScope ? formatterScope[formatter](value, object) : this.formatter(value, object); The code above makes it easy for ...
Ars Technica

Javascript problem with adding to innerHTML

I have a page with a number of fields available to input data. In the event the user has more data than is initially printed to the page, I have a button set up to add more fields to the page. It ...
GitHub

Utf8 emojis from innerHTML are sometimes grayed

I'm loading content of tooltip from HTML - like this: document.getElementById('something')).innerHTML There are some emojis: ️, ️, ⬅️ or ⬇️. It works but I see emojis in gray color - but ONLY ...
Ars Technica

Dynamically loading javascript source from a string into the DOM using Jquery

I'm experimenting with dynamic loading of javascript using JQuery. So basically I have a loadScript function that accepts either the URL of a JS file or a javascript source in a string. For the former ...