innerHTML → GitHub Gist
The location.hash version persists raw
markup directly through of unsanitizedInnerHTML on a
contenteditable element. Here the markup is edited as
text, in a plain <textarea> — persisted with
the ordinary of value rule below, no opt-in needed for that
part — and only the pointer (#gistID:…) lives in the URL.
The unsanitizedInnerHTML-style handshake (dispatch
securitypolicyviolation, require
event.anythingGoes = true) still gates the separate
preview further down, which is the part that actually renders
your text as live HTML.
gist://unsafe-html-demo/markup.html
Plain of value — an ordinary be-persistent rule; a
<textarea>'s value is always text, so it never
needs unsanitizedInnerHTML. The field starts empty, so
nothing is written until you type and leave it — no doomed create on
load. Typing fires input on every keystroke; this rule
uses on focusout instead so one gist PATCH
is sent when you leave the field, not one per key. Reload the page —
the text comes back from the gist.
This is the part that actually needs the opt-in.
#preview renders whatever is in the source field above
as live HTML via innerHTML — but only once it
dispatches securitypolicyviolation and its own
onsecuritypolicyviolation="event.anythingGoes = true"
handler agrees, the same handshake of unsanitizedInnerHTML
uses internally. Updates as you type, and once after a reload
restores the source from the gist.
unsafe-html-demo — no gist id recorded yet.
"Forget" only drops the local alias → id pointer in the
URL hash; the gist stays on GitHub. The next focusout
then creates a fresh gist.
fifteenth's raw form,
gist://<owner>/<id>/raw/<sha>/<file>,
reads a published file straight off
gist.githubusercontent.com — no token, no
/gists API call, no rate limit; the <sha>
pins an immutable revision. It's the tail of the
raw URL.