Comment by marcinw

Java, Python, etc don't have a DOM to consider.

When you're just an XSS away from an attacker doing:

  function encrypt(plaintext) {
    $.post(plaintext, ...);
    return plaintext;
  }

then you lose. The post talks about this, and XSS isn't the only way either.