3 ms·
The whole "htmx is the most dangerous thing to exist" is so funny to me. Someone that does not understand sanitisation boundaries has no business working on we
by eddd-ddde 3y ago
The whole "htmx is the most dangerous thing to exist" is so funny to me.
Someone that does not understand sanitisation boundaries has no business working on web development. This is how you end up with html in your database, people just render whatever piece of data because it "just works" in frameworks like react (I've seen it myself in production).
- moritzwarhier 3y agoReplace htmx with alpine js and I think the twitterers have some point. Eh, probably even with htmx. It is true that the average WordPress developer might not care about XSS, and to refute one specific point: I have seen third-party returning HTML, plenty of them. Deliberately acting on the contents response instead of directly executing code from said party forces you to think about XSS. But it's not specific to htmx of course, it would be the same when using innerHTML or something while using a field in a JSON API response. It's true that frameworks like React have safer defaults than Vanilla JS in that regard.