Earlier quoted context omitted.
Where do you suggest we sanitize values? Only in the client, when rendering them?
Depends on what you mean by sanitising. If you mean filtering out undesirable parts of a document (e.g. disallowing element or onclick attribute), that should normally be done on the server, before storage. If instead you mean serialising , writing a value into a serialised document: then this should be done at the point you’re creating the serialised document. (That is, where you’re emitting the HTML.) But the golde…
I think "normally" we should instead filter for XSS injections when we generate the DOM tree, or just before (such as passing backend data to the frontend, if that makes more sense).