A little bit of plain JavaScript can do a lot

Re:A little bit of plain JavaScript can do a lot by hombre_fatal on Sunday June 21, 2020 @03:51PM (#23594825)

Maybe my point wasn't clear, but {{{ and {{ look too similar. It should be {{ and something else. Like {{Dangerous=username}}.

You shouldn't have to squint at your templating code to see if there's an XSS vector or not, or defensively/neurotically grep for "{{{" just in case you didn't trust your team to squint sufficiently.

For comparison, here's JSX: <div dangerouslySetInnerHTML={{__html: username}} />.

vs. Mustache: {{{username}}} in a file of 1000 other { and } glyphs.

Mustache's hey-dey is long over thankfully.

[ Parent | on HN ]

Re:A little bit of plain JavaScript can do a lot by onei on Sunday June 21, 2020 @04:02PM (#23594924)

I agree that something possibly dangerous should be harder to mis-use. The world is full of small oversights. Having said that, surely this is the job of a linter - does one exist for mustache?

I've never seen JSX before (I haven't learned anything new in front-end later than ES5). In your example, it looks more like an attribute than an inner tag, the former of which I'd almost always escape. Is that how you set inner HTML as well?

[ Parent | on HN ]