Comment

Comment by franciscop

I tried making something like this (JSX with Template Literals) few times, they are languishing in unfinished JSFiddles. The main issue was making it XSS-safe by default, which as I see this hasn't achieved at all!

XSS demo 1: https://jsfiddle.net/hegLkz4s/2/

XSS demo 2: https://jsfiddle.net/hegLkz4s/4/

So, please do not use this, use React or similar well-tested libraries instead. There might be a way to make something like this that is XSS-safe by default (I got pretty close), but brutal.js does not seem to be it.

parent franciscop 8 years ago

Discussion

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton