Notices by Jason Miller 🦊⚛️ (developit@mastodon.social)

@aral it'd really only matter if you were doing something like allowing user-submitted content within your stylesheet. As soon as you jump into a variable in the htm template string, you're relying on vhtml's entity encoding to ensure that variable isn't interpreted as HTML. Works a bit differently than VDOM, where the template is never parsed or assigned as HTML.

@aral actually I think we could fix this in VHTML if you wanted - it's currently doing unnecessary entity encoding for text content. It should only be encoding `<`. The boolean prop thing it just something I forgot to add.

@aral careful with that sanitization bypass:

h('style', {}, '</style><script>alert("hi")</script>')

@aral oooh this looks much easier to package than mkcert...