title: Exploiting jquery html encoding XSS
body: <p>After reading <a href="https://stackoverflow.com/questions/5796718/html-entity-decode">this question</a> users warned that this method of encoding html is unsafe</p>
  
  <pre><code>    return $('&lt;div/&gt;').html(encodedText).text();
  </code></pre>
  
  <blockquote>
    <p>"don't use jQuery.html().text() to decode html entities as it's unsafe
    because user input should never have access to the DOM
    "</p>
    
    <p>"I suggest using a safer, more optimized function"</p>
  </blockquote>
  
  <p>The purpose of this method is to take encoded input i.e <code>Fish &amp;amp; chips</code> and produce unencoded output i.e <code>Fish &amp; Chips</code></p>
  
  <p>So as I understand it, they claim that for some value of <code>encodedText</code>, that javascript can be executed. I tried to reproduce this setting <code>encodedText</code> to <code>&lt;script&gt;alert(1)&lt;/script&gt;</code> and a few other simple attacks and was unable to find any signs of XSS vulnerability.</p>
  
  <p>My question is: is there any demonstrable xss vulnerability in any browser when using <code>$('&lt;div/&gt;').html(encodedText).text()</code></p>