Following up on my last question...
This code can be exploited if an attacker has access to encodedText:
return $('<div/>').html(encodedText).text();
e.g. $("<div/>").html('<img src="X" onerror="alert(\'hi\');" />').text() displays an alert.
This answer recommends using a textarea instead to avoid XSS vulnerability:
return $('<textarea/>').html(encodedText).text();
This was able to handle the previous exploit safely.
However, this answer indicates that there are still XSS vulnerabilities when using textarea:
I suggest using a safer, more optimized function
don't use jQuery.html().text() to decode html entities as it's unsafe because user input should never have access to the DOM
My question is: Is there a way in any browser to exploit $('<textarea/>').html(encodedText); to run XSS assuming attacker has access to encodedText?
$('<textarea/>').html('<script>alert()</script>').text();would still run the script. I don't see any benefit from using<textarea>.textareahandles the exploit I posted but not your even simpler one!onerrorevent when the<img>element is part of a<textarea>. But if the attacker has access toencodedTextthen simple script injection would run nonetheless. You need to ask yourself why isencodedTextcontrolled by the end-user? Is it something that stored in a database (sanitize it upon saving then), is it injected through some request parameter (don't do it, or at least try to manipulate it before parsing / attaching it to the DOM in any way).