The decode really, really, really should not be happening client side in Javascript. The backend should handle it before handing the text to the user’s browser. You are correct; If this is done client side it means a bad actor can mess with it and/or include an injection attack of some sort.
Nothing client side should ever handle user input, except perhaps convenience features like flagging incomplete fields or kicking the cursor to the next input element when one is full (e.g. for phone numbers). Anything client side can be fucked with by the client. Validation needs to happen on the server side, before committing the input to the database (or doing whatever it’s going to do with it).
The decode really, really, really should not be happening client side in Javascript. The backend should handle it before handing the text to the user’s browser. You are correct; If this is done client side it means a bad actor can mess with it and/or include an injection attack of some sort.
Nothing client side should ever handle user input, except perhaps convenience features like flagging incomplete fields or kicking the cursor to the next input element when one is full (e.g. for phone numbers). Anything client side can be fucked with by the client. Validation needs to happen on the server side, before committing the input to the database (or doing whatever it’s going to do with it).