[pull] main from mdn:main

files/en-us/web/api/audiobuffersourcenode/start/index.md

@@ -40,11 +40,12 @@ start(when, offset, duration)
     current playback rate, so even if the sound is playing at twice its normal speed, the
     midway point through a 10-second audio buffer is still 5.
 - `duration` {{optional_inline}}
-  - : The duration of the sound to be played, specified in seconds. If this parameter
-    isn't specified, the sound plays until it reaches its natural conclusion or is stopped
-    using the {{domxref("AudioScheduledSourceNode.stop", "stop()")}} method. Using this
-    parameter is functionally identical to calling `start(when, offset)` and
-    then calling `stop(when+duration)`.
+  - : The duration of the audio data to be played, specified as seconds of total buffer content.
+    If this parameter isn't specified, the sound plays until it reaches its natural conclusion or
+    is stopped using the {{domxref("AudioScheduledSourceNode.stop", "stop()")}} method. The
+    value is independent of the {{domxref("AudioBufferSourceNode.playbackRate")}}, so e.g., a
+    `duration` of 2 seconds with a `playbackRate` of `2` will play 2 seconds of the source,
+    producing a 1 second audio output.
 
 ### Return value
 

files/en-us/web/api/document/execcommand/index.md

@@ -79,7 +79,16 @@ execCommand(commandName, showDefaultUI, valueArgument)
     - `insertHorizontalRule`
       - : Inserts a {{HTMLElement("hr")}} element at the insertion point, or replaces the selection with it.
     - `insertHTML`
-      - : Inserts an HTML string at the insertion point (deletes selection). Requires a valid HTML string as a value argument.
+      - : Inserts an {{domxref("TrustedHTML")}} instance or string of HTML markup at the insertion point (deletes selection).
+        This requires valid HTML markup.
+
+        > [!WARNING]
+        > The input is parsed as HTML and written into the DOM.
+        > APIs like this are known as [injection sinks](/en-US/docs/Web/API/Trusted_Types_API#concepts_and_usage), and are potentially a vector for [cross-site scripting (XSS)](/en-US/docs/Web/Security/Attacks/XSS) attacks, if the input originally came from an attacker.
+        >
+        > You can mitigate this risk by always assigning {{domxref("TrustedHTML")}} objects instead of strings and [enforcing trusted types](/en-US/docs/Web/API/Trusted_Types_API#using_a_csp_to_enforce_trusted_types).
+        > See the [Trusted Types API](/en-US/docs/Web/API/Trusted_Types_API) for more information.
+
     - `insertImage`
       - : Inserts an image at the insertion point (deletes selection). Requires a URL string for the image's `src` as a value argument. The requirements for this string are the same as `createLink`.
     - `insertOrderedList`