Soft hyphen paste in editor is not correctly handled

[Sesquipedalian]

We do. It was a simple example.

[Arantor]

You removed literally all of the inline JavaScript such that you could write a CSP that would block said attack?

Mind you, while I see the point you're trying to make, there is a question very firmly about user expectations vs security and that the fact this topic exists suggests there is a disparity.

It's fine here where you can explain "oh it's best practice" and that's a good enough explanation, but that's rarely a situation I can do out in the real world. I just get told to fix it, and so I have my ways of doing that.

[Sesquipedalian]

I mean that we remove any attempt to embed JavaScript in user input.

[Arantor]

*shrug* I haven't looked, if you're saying it's secure, I trust you. Your code base, not mine.

I'm just mindful that I have other considerations in choosing how I'd solve this, and still have it be secure.