The model answered The main heading says **"Example Domain"** and the page drew the asterisks.
Everything in this page is built with textContent, and that is not the oversight to correct: it is the reason the pane is safe. The text arriving in it was written by a model that had just read arbitrary web pages, so its content is chosen by whoever wrote the last page it visited. Putting that through the HTML parser is the documented road to exfiltration by injected image, and no amount of sanitising makes that road shorter than building the nodes by hand.
What it does
The marks become elements and everything between them stays text: bold, italic, inline code, fenced blocks. An unclosed fence is still shown as code, because the alternative is prose that changes shape when the closing fence arrives.
Deliberately absent: images, which are the exfiltration vector itself, and links, which this pane has no reason to make clickable when the browser it drives is sitting right next to it.
Verified, not asserted
Against the real model in a browser: the answer comes back with two rendered bold spans and no literal asterisks.
Fed a hostile string by hand, the renderer produced strong, em, code and pre, and zero img, a or script elements, with the script tag surviving as literal characters because it never stops being a text node.
The test asserts the invariant rather than the output: no assignment to the HTML property, no insertAdjacentHTML, no document.write, and no img or a constructed anywhere. It checks the assignment and not the word, because both the page and the test discuss that property in prose precisely because neither may use it - a check tripped by the sentence explaining the rule is the defect this project writes down most often.
Test plan
-
pytest -q: 361 passed, 3 xfailed unchanged - the renderer driven by hand against a hostile string: 0 img, 0 a, 0 script, the tag stays text
- end to end with the real model: 2 bold spans rendered, 0 literal asterisks
- version, english and content gates clean