Description Mark Macdonald 2012-10-19 11:57:38 EDT

The signature for dojo.place is:
 dojo.place(node, refNode, pos)

It allows the first parameter to be a string giving an HTML fragment. When the HTML string contains untrusted content, this coding pattern is insecure. For example, this is bad:

  dojo.place("<h2>" + messages["SectionHeader"] + "</h2>", whatever);

But this is OK since the HTML fragment is a constant value:

 dojo.place("<h2>Hello</h2>", whatever);

Anyone using the first pattern needs to use proper DOM APIs instead.

[1] http://dojotoolkit.org/reference-guide/1.8/dojo/dom-construct.html#dojo-dom-construct-place