;const username = "Bob the XSS guy <script>alert(1)</script>";const userFormHtml = autoHtml `Username: `;console;// "<div>Username: Bob the XSS guy <script>alert(1)</script></div>"
If you really want to substitute in HTML, then use an object with an
property. Be careful that the html is properly encoded! This syntax is inspired
const username = "Bob the XSS guy <script>alert(1)</script>";const comment = "Some **markdown** text";const commentHtml = ; // markdownToHtml not included.const postHtml = autoHtml `Username:`;console;// <div class="post">// <div>Username: Bob the XSS guy <script>alert(1)</script></div>// <div>Some <strong>markdown</strong> text</div>// </div>
This module can be used in browsers via a CommonJS bundler such as Browserify or Webpack.
The HTML encoding is done by Lodash's escape function. Text encoded into HTML by this function is safe to be placed in HTML element attributes and as an element's children.
Use of Content Security Policy headers is highly recommended to prevent XSS attacks! You'll still want to bother to encode your HTML correctly, but CSP headers stop that from being a remote-code-execution security issue at least.
Both TypeScript and Flow type definitions for this module are included! The type definitions won't require any configuration to use.