The world of business-to-business enterprise software has always required a high level of custom per-client markup associated with branding and customization. In a SPA that generally means injecting markup in script.
Some posts tout frameworks like angular.js for safer rendering of this type. However, there is increasing pressure to shift away from frameworks towards vanilla script in many situations. There are benefits to performance, integration, maintenance, and so on. This is fueled by increasing size and complexity of existing frameworks, new major releases which depart radically from prior ones, and the constant churn in the JavaScript framework market.
What are the correct client-side security measures to inject markup using vanilla JS?
Please do not flag this as a duplicate of more general client-side XSS questions without the vanilla js requirement or the requirement for custom per-client (this could be termed untrusted, but unknown might be more accurate as it emanates from the client) markup.