Rule proposal: prefer getHTML/setHTML to .innerHTML

[fregante]

Description

See context for the Sanitizer API in https://fullystacked.net/innerhtml-alternatives/

Fail

main.innerHTML = '<h2>Mambo Nº2</h2>'

console.log(main.innerHTML);

Pass

main.setHTML('<h2>Mambo Nº2</h2>')

console.log(main.getHTML());

Related

• Expand prefer-dom-node-text-content against .innerHTML or implement no-inner-html rule #1405

[DEVTomatoCake]

According to MDN all major browsers removed support for <Element>.setHTML() (though not <Element>.getHTML()) again, according to Can I use it's available in about 5% of browsers. It's still in the spec, however that doesn't help if all users should be able to use your website.

Why would you prefer something which breaks the site for most users, especially on recent browser releases, with no apparent benefits by itself (if you don't use sanitizers), over something which has been working since many years?

[fregante]

The linked article has more info on why. The rule might take years to be added and even then it could be left disabled by default until Chrome implements it again. Browsers are quick to update nowadays