title: Is HTML5's contenteditable attribute supposed to be XSS safe?
body: <p>I have read the somewhat related question <a href="https://stackoverflow.com/q/8086847/1711186">div contenteditable, XSS</a>, but its answers do not highlight much about the XSS saftey of contenteditable. In particular with regards to accidental (as compared to intential cross-site-scripting). I am, of course, aware that I should sanitize user input server-side. </p>
  
  <p><em>TL.DR.</em>: Can I be certain that the user does not stand risk to introduce some external script(i.e. via data pasted from the clipboard) via a page Element being set <code>contenteditable</code>? Does the spec make certain that any markup pasted to the contenteditable is sanitized before being inserted into the DOM?</p>
  
  <p>I have noticed that on two major Browsers I tested, Chromium/Chrome and Firefox, that it seems to be impossible to accidentally insert an <em>active Elements</em>  into the <code>contenteditable</code> tag. An example for such an accedental insertion I would have imagined to be for instance:</p>
  
  <ul>
  <li>user copies a Selection of DOM Elements from one webpage and inserts them into the <code>contenteditable</code> Element on another site. </li>
  <li>user does (on linux command line) <code>echo "&lt;b onclick='alert("XSS");'&gt;click me&lt;/b&gt;" | xclip -t text/html -selection "clipboard"</code> and pastes that into the <code>contenteditable</code>. </li>
  </ul>
  
  <p>An <em>active element</em> would be anything like:</p>
  
  <ul>
  <li>html markup containing a <code>&lt;script&gt;</code> </li>
  <li>html markup containing elements with inline handlers such as <code>onclick="alert(\"XSS\");"</code></li>
  <li>html markup containing javascript hrefs such as <code>&lt;a href="javascript:alert(\"XSS\")"&gt; click me &lt;/a&gt;</code></li>
  </ul>
  
  <p>Now my question is, seeing that contenteditable seems somewhat safe from having any normal XSS vector being pasted into, if that is by design?</p>
  
  <p>I have read some <a href="https://www.w3.org/TR/2008/WD-html5-20080610/editing.html#contenteditable0" rel="nofollow noreferrer">specs/refs/whatever</a> where it does neither explicitly mention that <code>contenteditable</code> should prevent any <em>active Element</em> being inserted into the DOM of the page, neither that it would be allowed. This leaves me in doubt if I should use the contenteditable feature, as I do not want to risk some external javascript being inserted into <code>contenteditable</code>. Answer this XSS safety of <code>contenteditable</code> is the core of this question.</p>
  
  <p><strong>Update</strong>
  In contrast to the <code>contenteditable</code> attribute the similar feature documents <code>designMode</code>, seems to be specific (see <a href="https://www.w3.org/TR/2008/WD-html5-20080610/web-browsers.html#designModeScriptBlocked" rel="nofollow noreferrer">https://www.w3.org/TR/2008/WD-html5-20080610/web-browsers.html#designModeScriptBlocked</a>) about the javascript being disabled (hence XSS prevented). </p>
  
  <p><strong>UPDATE 2</strong>
  The most recent reference/spec cited on MDN is <a href="https://html.spec.whatwg.org/multipage/interaction.html#contenteditable" rel="nofollow noreferrer">https://html.spec.whatwg.org/multipage/interaction.html#contenteditable</a>
  which is oddly indifferent about any guarantees that <code>contenteditable</code> provides to not introduce malicous javascript via paste. </p>