{"action":"created","issue":{"url":"https://api.github.com/repos/nicojs/typed-html/issues/5","repository_url":"https://api.github.com/repos/nicojs/typed-html","labels_url":"https://api.github.com/repos/nicojs/typed-html/issues/5/labels{/name}","comments_url":"https://api.github.com/repos/nicojs/typed-html/issues/5/comments","events_url":"https://api.github.com/repos/nicojs/typed-html/issues/5/events","html_url":"https://github.com/nicojs/typed-html/issues/5","id":306727829,"number":5,"title":"escaping of element content","user":{"login":"mark-buer","id":2610458,"avatar_url":"https://avatars3.githubusercontent.com/u/2610458?v=4","gravatar_id":"","url":"https://api.github.com/users/mark-buer","html_url":"https://github.com/mark-buer","followers_url":"https://api.github.com/users/mark-buer/followers","following_url":"https://api.github.com/users/mark-buer/following{/other_user}","gists_url":"https://api.github.com/users/mark-buer/gists{/gist_id}","starred_url":"https://api.github.com/users/mark-buer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mark-buer/subscriptions","organizations_url":"https://api.github.com/users/mark-buer/orgs","repos_url":"https://api.github.com/users/mark-buer/repos","events_url":"https://api.github.com/users/mark-buer/events{/privacy}","received_events_url":"https://api.github.com/users/mark-buer/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-03-20T04:43:49Z","updated_at":"2018-03-20T06:54:47Z","closed_at":null,"author_association":"NONE","body":"Perhaps I'm missing something, but it appears that this library doesn't escape string content within elements?\r\n\r\nThis is somewhat unexpected since regular old React does perform escaping.\r\n\r\nIt is probably a security concern since outside content within a template can effectively inject any element, including script elements, into the generated html."},"comment":{"url":"https://api.github.com/repos/nicojs/typed-html/issues/comments/374494646","html_url":"https://github.com/nicojs/typed-html/issues/5#issuecomment-374494646","issue_url":"https://api.github.com/repos/nicojs/typed-html/issues/5","id":374494646,"user":{"login":"nicojs","id":1828233,"avatar_url":"https://avatars3.githubusercontent.com/u/1828233?v=4","gravatar_id":"","url":"https://api.github.com/users/nicojs","html_url":"https://github.com/nicojs","followers_url":"https://api.github.com/users/nicojs/followers","following_url":"https://api.github.com/users/nicojs/following{/other_user}","gists_url":"https://api.github.com/users/nicojs/gists{/gist_id}","starred_url":"https://api.github.com/users/nicojs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nicojs/subscriptions","organizations_url":"https://api.github.com/users/nicojs/orgs","repos_url":"https://api.github.com/users/nicojs/repos","events_url":"https://api.github.com/users/nicojs/events{/privacy}","received_events_url":"https://api.github.com/users/nicojs/received_events","type":"User","site_admin":false},"created_at":"2018-03-20T06:54:47Z","updated_at":"2018-03-20T06:54:47Z","author_association":"OWNER","body":"@mark-buer thanks for reporting this issue!\r\n\r\nI've created this project without the use case in mind of allowing user content to be rendered, and thus have not thought about the security aspect of it.\r\n\r\nWhat do you mean exactly? Could you illustrate with an example?\r\n\r\nTake this piece of code for example:\r\n\r\n```ts\r\nconst script = <script>alert('hacked!')</script> ;\r\nconst body = <body>{script}</body>;\r\n```\r\n\r\nthis works by design, because we cannot differentiate this from this piece of code:\r\n\r\n```ts\r\nconst body = <body><script>alert('hacked!')</script> </body>;\r\n```\r\n\r\nIs this what you mean?"}}
{"actor":{"display_login":"nicojs"}}