{"action":"opened","issue":{"url":"https://api.github.com/repos/straker/html-tagged-template/issues/15","repository_url":"https://api.github.com/repos/straker/html-tagged-template","labels_url":"https://api.github.com/repos/straker/html-tagged-template/issues/15/labels{/name}","comments_url":"https://api.github.com/repos/straker/html-tagged-template/issues/15/comments","events_url":"https://api.github.com/repos/straker/html-tagged-template/issues/15/events","html_url":"https://github.com/straker/html-tagged-template/issues/15","id":135801664,"number":15,"title":"How should we allow safeHTML","user":{"login":"straker","id":2433219,"avatar_url":"https://avatars.githubusercontent.com/u/2433219?v=3","gravatar_id":"","url":"https://api.github.com/users/straker","html_url":"https://github.com/straker","followers_url":"https://api.github.com/users/straker/followers","following_url":"https://api.github.com/users/straker/following{/other_user}","gists_url":"https://api.github.com/users/straker/gists{/gist_id}","starred_url":"https://api.github.com/users/straker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/straker/subscriptions","organizations_url":"https://api.github.com/users/straker/orgs","repos_url":"https://api.github.com/users/straker/repos","events_url":"https://api.github.com/users/straker/events{/privacy}","received_events_url":"https://api.github.com/users/straker/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/straker/html-tagged-template/labels/discussion","name":"discussion","color":"5319e7"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-02-23T17:17:14Z","updated_at":"2016-02-23T17:17:14Z","closed_at":null,"body":"Currently any variable is safely encoded when placed inside a text node. However, we should definitely have someway for the user to mark that the HTML is trusted and that it should be rendered as DOM elements rather than text nodes. However we decided to do it, an attacker shouldn't be able to mark their own string as trusted (e.g. using an expression to do so)."}}