search

google / incremental-dom

An in-place DOM diffing library
http://google.github.io/incremental-dom/
Apache License 2.0
3.54k stars 180 forks source link

Ban setting special attributes #451

Open vrana opened 4 years ago

vrana commented 4 years ago

This prevents circumventing our checks by code like <script text="{$evil}"> or <i innerHTML="{$evil}"> in Soy IDOM.

The newly added test is flaky. Any idea why?

iteriani commented 4 years ago

Shouldn't the soy compiler be handling this?

vrana commented 4 years ago

This seems like a better place. I see no point in abusing attr() for setting properties like innerHTML that are not real attributes.

iteriani commented 4 years ago

OK. I'm a bit apprehensive about landing a breaking change since people use Incremental DOM at HEAD. Do you mind moving this internally into google3 soy?