2 ms·
It doesn't throw, the unsafe version is just escaped by the browser: Let's consider a container where a function like `header` would be used: const page =
by spankalee 8y ago
It doesn't throw, the unsafe version is just escaped by the browser:
Let's consider a container where a function like `header` would be used:
const page = (title, body) => html`
${header(title)}
<p>${body}</p>
`;
If you use the safe version, you might get:
<h1>Foo</h1>
<p>Bar</p>
but if you use the unsafe version, you'd get:
<h1>Foo</h1>
<p>Bar</p>
See a demo here: https://stackblitz.com/edit/lit-html-escaping?file=index.js https://stackblitz.com/edit/lit-html-escaping?file=index.js
- franciscop 8y agoAh cool, that works as well from a security point of view. I slightly prefer throwing, but that is highly opinionated.