javascript - Exploiting jQuery HTML decoding using textarea -

this code can exploited if attacker has access encodedtext:

return $('<div/>').html(encodedtext).text();

e.g. $("<div/>").html('<img src="x" onerror="alert(\'hi\');" />').text() displays alert.

this answer recommends using textarea instead avoid xss vulnerability:

return $('<textarea/>').html(encodedtext).text();

this able handle previous exploit safely.

however, this answer indicates there still xss vulnerabilities when using textarea:

i suggest using safer, more optimized function

don't use jquery.html().text() decode html entities it's unsafe because user input should never have access dom

my question is: there way in browser exploit $('<textarea/>').html(encodedtext); run xss assuming attacker has access encodedtext?

i wouldn't risk honest, lot safer if handled needed encrypted or unencrypted server-side.

JVParth