Escape HTML in autocomplete tooltips

fsbolero / TryFSharpOnWasm

F# Compiler running in WebAssembly with Bolero

Apache License 2.0

38 stars 4 forks source link

Escape HTML in autocomplete tooltips #1

Open Tarmil opened 5 years ago

Tarmil commented 5 years ago

Currently autocomplete tooltips aren't escaped for HTML, so they can do some injection.

screenshot

For a more realistic and confusing scenario, this means that a value of type eg List<string> will show as just List with an invisible and meaningless <string> HTML tag.