Range.createContextualFragment()

Warning: This method parses its input as HTML or XML, writing the result into a DocumentFragment that might subsequently be injected into the DOM. APIs like this are known as injection sinks, and are potentially a vector for cross-site scripting (XSS) attacks, if the input originally came from an attacker. You can reduce the risk by assigning TrustedHTML objects instead of strings, and enforcing trusted types using the require-trusted-types-for CSP directive. This ensures that the input is passed through a transformation function, which has the chance to sanitize the input to remove potentially dangerous markup, such as script elements and event handler attributes.