News for hackers. Stuff that matters.

A comment on Show HN: Generate styled web pages with just Python. Parent comment

Re:Show HN: Generate styled web pages with just Python by pbronez on Wednesday March 22, 2023 @08:22AM (#35259956)
Seems like that should just be a warning in the docs, since mostly we’re talking about trusted code written by the dev…. Although maybe that’s untrusted from your perspective as a PaaS?

What’s the escape hatch to write custom HTML in the Python source?

[ Parent | on HN ]
Re:Show HN: Generate styled web pages with just Python by ashishsingal on Wednesday March 22, 2023 @08:59AM (#35260308)
there's "HTML (.add_html)" in the docs - "Renders raw HTML. This is meant to be an escape hatch for when you need to render something that isn't supported by PyVibe." I'm guessing this isn't sanitized and we trust the dev. After all, they can do "eval" in Python which is much riskier than raw HTML :)
[ Parent | on HN ]
Re:Show HN: Generate styled web pages with just Python by akx on Thursday March 23, 2023 @06:32AM (#35272572)
All of the components support rendering arbitrary HTML, which is exactly the problem.
[ Parent | on HN ]
Re:Show HN: Generate styled web pages with just Python by akx on Thursday March 23, 2023 @06:35AM (#35272589)
No escape hatch is required since nothing is escaped...
[ Parent | on HN ]