[docs] Add info on automatic XSS-prevention / escaped characters
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 142
- Forks
- 230
- PR merge metrics
- No merged PRs in 30d
Description
# Description
In this article, it mentions that 'lit-html' includes XSS-prevention. That's what lead me to this library.
https://benfrain.com/html-templating-with-vanilla-javascript-es2015-template-literals/
Naturally, I wanted to verify that before using lit-html so I searched for 'escape' and 'XSS' in the documentation, but I wasn't able to find any mention of that functionality anywhere.
By trial and error, I found out that lit-html automatically removes tags when using the html tagged template literal.
I also could not find info about the unsafeHTML directive in the docs although it is included in the source code.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No documentation file or test is named in the issue. Start by locating the article's existing XSS and escaping guidance, then review the source's unsafeHTML directive and the automatic handling of script tags. Done means the documentation explains the escaping behavior and unsafeHTML clearly, with appropriate usage guidance.
Written by the indexing model from the issue text.
Assessment
- Domain
- documentation
- Issue type
- Documentation
- Difficulty
- 2/5
- Estimated time
- Half a day
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100