HTML tags should be encoded about snabbdom-to-html HOT 6 CLOSED

This module is actually using lodash.escape already haha, which does that exactly:

https://lodash.com/docs/#escape
https://github.com/snabbdom/snabbdom-to-html/blob/master/package.json#L29

I'll try and fix this over the weekend. PR's are welcome too :-)

from snabbdom-to-html.

Actually, it is enough to encode just the <>"&. This is how preact does it:

https://github.com/developit/preact-render-to-string/blob/1a04dc098a24dd916db79990d50a3ebb0c7a6976/src/util.js#L21

from snabbdom-to-html.

Thanks for pointing this out.

Indeed snabbdom uses document.createTextNode, which I guess does the encoding. See https://github.com/snabbdom/snabbdom/blob/master/src/htmldomapi.ts#L27-L29

What do you think would be the simplest way to do the encoding and apply it to vnode.text? https://github.com/snabbdom/snabbdom-to-html/blob/master/init.js#L33

from snabbdom-to-html.

I am not aware of built-in Node.js modules that would encode HTML. I searched on npm and seems like the he is the most popular package for encoding/decoding HTML

from snabbdom-to-html.

Another hand-made take https://github.com/stasm/innerself/blob/master/sanitize.js

from snabbdom-to-html.

@zkochan, @acstll: Hi! This does not seem to be fixed, so I've tried to address the issue in #38

from snabbdom-to-html.