binding safe HTML to a template

[jmesserly]

I was wondering the recommended way of doing something like this:

<template bind>
  member name: {{memberName}}
  member api docs:
  <div>{{memberDocs}}</div>
</template>

Here, memberName is a string, but memberDocs is an HTML fragment generated from Markdown.

It would be nice if there was a way to bind this through templates. To avoid XSS, you want some assurance that the HTML fragment was either fully controlled by the application or validated. What we did was introduce a type like "SafeHtml" which is constructed something like "SafeHtml.unsafe" (or via a validator, if you have one). The idea there is to give security reviews a nice way to find interesting spots in the application, and makes accidental mistakes a lot less likely.

@sigmundch @ebidel

[jmesserly]

fyi, some links to SafeHtml in other frameworks: Closure templates: https://developers.google.com/closure/templates/docs/security GWT: https://developers.google.com/web-toolkit/doc/latest/DevGuideSecuritySafeHtml Dart: https://github.com/dart-lang/web-ui/blob/master/lib/safe_html.dart

edit: fixed Closure link :)

[jmesserly]

CC: @xtofian

[rafaelw]

So one way I'm thinking that binding markup to be parsed can work is binding to the 'content' of a