Comment on Show HN: Zero – DX focused non framework to interact with the DOMComments−dvh1yIsn't there xss in the first demo? What if title is user supplied and it's something like <script>alert("xss")</script>−_nhhOP1yUser supplied stuff must always be sanitized :)
Comments
Isn't there xss in the first demo? What if title is user supplied and it's something like <script>alert("xss")</script>
User supplied stuff must always be sanitized :)