Closed jacobslusser closed 5 years ago
Love the project.
I would like to know what the default HTML encoding behavior is for both Liquid and Scriban? i.e.
value = "<script>alert('attack!');</script>"
<h1>{{ value }}</h1>
Which of the following would it produce by default:
<h1><script>alert('attack!');</script></h1>
or
<h1><script>alert('attack!');</script></h1>
there is no encoding related to HTML, scriban is mostly agnostic about it's usage.
There is an html.escape function for example to escape a HTML string
html.escape
Love the project.
I would like to know what the default HTML encoding behavior is for both Liquid and Scriban? i.e.
Which of the following would it produce by default:
or