2 ms·
Wow, XSS just waiting to happen. <h3>${this.getAttribute('title')}</h3>
by lukax 8mo ago
Wow, XSS just waiting to happen.
<h3>${this.getAttribute('title')}</h3>
- benatkin 8mo agoIt looks similar to Lit code, but it's not Lit, so yes, it is XSS waiting to happen all right. If it were Lit it would be escaped. It would start with html` which evaluates to a TemplateResult and the render() function only accepts a TemplateResult.
- teg4n_ 8mo agoHow? If the attribute is not trusted doesn’t that mean the dom is already compromised?