Some JavaScript frameworks or libraries use the DOMParser API to parse XML files from the client.

Is it safe to do this? Malicious code can easily be embedded into the XML file (in either the definition of nodes or their attributes). Does DOMParser prevent/filter malicious scripts in any way?

In case I want to use DOMParser myself, what do I need to do to prevent attacks through malicious scripts?



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.