Rendering Markdown comments safely: setHTML(), DOMPurify, and Trusted Types

2026-10-13

Agustin Barrientos shows how marked.js keeps raw HTML in comments and why “we sanitize” means little when library defaults differ so much. He defines one explicit allowlist in the SanitizerConfig format, uses it with setHTML() where available and DOMPurify as a fallback, and enforces Trusted Types so no one can bypass it with a raw innerHTML assignment.

agustinbarrientos.com/writing/senior-eye/rendering-markdown-comments-safely

Tags api html js security

October 7
A flame needs three sine waves
From pencil sketches to a canvas match that strikes, burns, and flickers like a real one.
October 2
The JavaScript midlife crisis
Rewriting tools in Rust, Go, and Zig makes them faster, but fewer developers can maintain them.
September 22
Responsive iframes in Chrome 154
An embedded frame grows with its content, no postMessage height plumbing.
September 17
Modern web types
A drop-in replacement for TypeScript’s DOM types with a single-engine threshold.
September 14
The browser’s main thread is expensive
Splitting, batching, and offloading work to keep every frame under 10 milliseconds.
September 9
You don’t need initial-scale in your HTML
Two authors landed on the same viewport meta element finding hours apart.
September 4
Fine, I’ll build my own text editor!
Canvas, contenteditable, and textarea compared for building an editor in the browser.
August 31
Highlighting a range of text inside a form field
The Custom Highlight API finally reaches form controls thanks to OpaqueRange in Chromium 152.