3 ms·
Umm, how do the templates escape malicious input (XSS)?
by aitchnyu 3y ago
Umm, how do the templates escape malicious input (XSS)?
- pabc1 3y agoIt seems to be based on lit-html, so anything that's interpolated gets automatically sanitised unless you're using a directive[1] or interpolate other templates created using the "html" function. [1]: https://lit.dev/docs/api/directives/#unsafeHTML https://lit.dev/docs/api/directives/#unsafeHTML
- kennyfrc 3y agoI've mainly designed this for backend devs (i.e. rails, django people who just render plain html/css on the front-end), and we generally do HTML sanitization on the server side. Example: https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html https://api.rubyonrails.org/classes/ActionView/Helpers/Sanit...