We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
1 parent 7e3b94c commit eee2ef7Copy full SHA for eee2ef7
packages/@glimmer-workspace/integration-tests/test/trusted-html-test.ts
@@ -40,6 +40,10 @@ export class TrustedHTMLTests extends RenderTest {
40
return policy?.createHTML(html);
41
});
42
43
+ // To keep rendering behavior consistent with SafeString
44
+ // trustedHTML is not encoded or decoded in attribute value context.
45
+ // It is set as string, that means result value can contain HTML enitites.
46
+ // TrustedHTML value must not escape from HTML attribute value context to prevent XSS.
47
this.render('<a title="{{trustedHTML}}">{{trustedHTML}}</a>');
48
this.assertHTML('<a title="<b>test\'"&quot;</b>"><b>test\'""</b></a>');
49
this.assertStableRerender();
0 commit comments