
Rendering Markdown Comments Safely: setHTML(), DOMPurify, and Trusted Types
How to render a Markdown comment safely in every place it shows up, with one policy for setHTML() and DOMPurify, and Trusted Types to catch code that writes the comment with innerHTML instead.



