The new .setHTML() method in JavaScript, part of the Sanitizer API, can be a one-to-one replacement for .innerHTML(), making sites more secure from XSS attacks. I think that’s pitch-perfect feature branding from Mozilla on this: Goodbye innerHTML, Hello setHTML: Stronger XSS Protection in Firefox 148.
Listen to Frederik Braun go deep into this on ShopTalk recently and a bonus blog post where he shows the recipe to make only setHTML work “essentially removing all DOM-XSS risks”.
