Product wants users to write rich-text comments with bold, links and images, and see them rendered. An engineer proposes `innerHTML` with a regex that strips `<script>` tags. Convince me either way.
Answer it out loud before you open anything. The value of the flags below is in comparing them to what you actually said.
The situation behind the question
A B2B collaboration tool. Comments are visible to everyone in a workspace, including admins. The workspace has SSO and an admin panel on the same origin.
What it is really testing
Whether the candidate understands XSS as a sink problem rather than a filtering problem, and whether they can describe the actual blast radius on a same-origin admin surface. The regex is the discriminator: everybody says "that is unsafe"; the good answer says exactly why filtering by pattern cannot work.