3 ms·
> If `name` is a user-provided string, it can never insert a <script> or <img> tag, etc., because it's escaped. Be careful with that "never". A curious and per
by cratermoon 2y ago
> If `name` is a user-provided string, it can never insert a <script> or <img> tag, etc., because it's escaped.
Be careful with that "never". A curious and persistent person might discover a bug in the implementation, leading to something like the Log4Shell issue.
- VBprogrammer 2y agoNot sure why you are being downvoted here. It's a fair point and properly escaping your data is only one part of the overall security picture but you should also be strictly validating data at the inputs to your system too.
- spankalee 2y agoLuckily, for Lit specifically, the "escaping" is done by the browser by setting textContent, so the string literally never passes through the HTML parser. Any string is valid text content, and if you found a bug that permitted unsafe text to be parsed as HTML somehow, it would be a browser bug and a very, very serious one. But it'd be similar with with other template systems. If the interpolation should allow any string, there's really no validation to be done.