javascript - Exploiting jquery html encoding XSS -

this question has answer here:

• how decode html entities using jquery? 17 answers

after reading this question users warned method of encoding html unsafe

    return $('<div/>').html(encodedtext).text(); 

"don't use jquery.html().text() decode html entities it's unsafe because user input should never have access dom "

"i suggest using safer, more optimized function"

the purpose of method take encoded input i.e fish & chips , produce unencoded output i.e fish & chips

so understand it, claim value of encodedtext, javascript can executed. tried reproduce setting encodedtext <script>alert(1)</script> , few other simple attacks , unable find signs of xss vulnerability.

my question is: there demonstrable xss vulnerability in browser when using $('<div/>').html(encodedtext).text()

there plenty of ways of doing it, 1 way onerror image tag.

var x = $("<div/>").html('<img src="x" onerror="alert(\'hi\');" />').text();  console.log(x);

<script src="https://ajax.googleapis.com/ajax/libs/jquery/1.11.1/jquery.min.js"></script>