XSS why \n must be replaced by \n<br>

Question

I came across the following xss fix. The old code was:

this.commentText = new Text(Sanitizer.sanitizeForHtml(commentText.getValue()));

The xss fix code is:

String sanitizedText = Sanitizer.sanitizeForHtml(commentText.getValue()).replace("\n", "\n<br>");

Can you please clarify to me how \n can be used in XSS? and how replacing it with \n<br> will solve the problem?

Answer 1

It is not meant as a protection against XSS and there is no common context where it would do.

Instead, the authors solve the problem that the newline character (\n) does not display a new line in HTML, so they add the <br> tag to enforce a visible line break.

The authors of the code even explain it in a comment themselves here:

//replacing "\n" with "\n<br>" here is to make comment text support displaying breakline
String sanitizedText = Sanitizer.sanitizeForHtml(commentText.getValue()).replace("\n", "\n<br>");

Answer 2

Imagine the dev want to output user input in a javascript variable.

If the user input with \n it will render as

var input = " hey
there"

Which in a <script> will render as an error and will cause it to be not executed because your string is not terminated ! Instead, replacing \n with <br> will result to the very correct var input = "hey<br />"