Escaping attributes, css, javascript, url's

weavejester / hiccup

Fast library for rendering HTML in Clojure

http://weavejester.github.io/hiccup

Eclipse Public License 1.0

2.68k stars 174 forks source link

Escaping attributes, css, javascript, url's #129

Open danielcompton opened 8 years ago

danielcompton commented 8 years ago

The Owasp XSS cheatsheet talks about escaping html, attributes, css, javascript, and URLs. It seems like Hiccup does html and url escaping, but doesn't provide functions for escaping the others. Is my understanding correct, and would you be open to a patch for this? I'm not quite sure yet whether it would be possible to integrate it into the escape-html function, or if they would need to be separate functions.

Relates to #122.

weavejester commented 8 years ago

The OWASP rules seem rather aggressive. They might conceivably protect against possible bugs in the browser, but they also make the output harder to read. I think I'd want this to be implemented as a non-default option, once #122 is merged.