Can anyone provide a basic rundown of how Lemmy handles input sanitization?

I ask because I want to know if it is necessary for lemmy userscripts to sanitize the content of comments for security purposes or if I can reasonably expect that this has already occurred.

My specific concern is whether the innerHTML attribute of comments can still contain harmful scripts even after Lemmy's sanitization procedure.

I am not very familiar with rust and it's not obvious to me from skimming the source code. Some of the git issues hint at it occurring server side while others in the ui?

Questions:

• Where does input sanitization occur?
• Does the sanitization simply prevent injection or does it further more reject the comment/entirely remove the script from comment/ban user etc?
• Can posts and comments still contain potential threats via a userscript vector?
• How is sanitization handled with regard to federation? ie; are comments received from federation also sanitized despite not being input directly by the user on the receiving server?

I know it would be good practice to just sanitize it in the userscript anyways but I would still like to know what's happening on the Lemmy side.

I would be very surprised if the lemmy server would sanitize comment bodies, as they are just supposed to be markdown input. That's the responsibility of the frontend, like lemmy-ui. Depending on the markdown library used, it could either just remove any HTML elements or escape them.

I guess we could try it out right here:

looks like it's the latter for lemmy-ui. (And the former for mlmym, which is my default frontend.)