I have a JavaScript AJAX call that pulls in HTML code into an MVC form.
Coverity flags that because it wants me to sanitize JavaScript tags. Quite rightly because you don't want some hacker to go in and mess things right up.
I put in a Trusted HTML Policy. That satisfies Coverity. But now the HTML code shows up as plain-text on the screen.
So $(target).html(result) is no longer behaving how I expected it to.
I tried different methods: innerHTML, $.parseHTML() and .text().html() all do not give me the desired results.
I even commented out the TrustedHTML policy and put in a replace function instead. That didn't work.
All I have is a string of HTML showing up as plain text on the screen.
I comment out the TrustedHTML and the replace function and it works as intended. But Coverity hates it.