{"action":"created","issue":{"url":"https://api.github.com/repos/emberjs/ember.js/issues/12137","labels_url":"https://api.github.com/repos/emberjs/ember.js/issues/12137/labels{/name}","comments_url":"https://api.github.com/repos/emberjs/ember.js/issues/12137/comments","events_url":"https://api.github.com/repos/emberjs/ember.js/issues/12137/events","html_url":"https://github.com/emberjs/ember.js/issues/12137","id":101641308,"number":12137,"title":"Bound style attribute warnings and `Ember.String.htmlSafe`","user":{"login":"workmanw","id":825487,"avatar_url":"https://avatars.githubusercontent.com/u/825487?v=3","gravatar_id":"","url":"https://api.github.com/users/workmanw","html_url":"https://github.com/workmanw","followers_url":"https://api.github.com/users/workmanw/followers","following_url":"https://api.github.com/users/workmanw/following{/other_user}","gists_url":"https://api.github.com/users/workmanw/gists{/gist_id}","starred_url":"https://api.github.com/users/workmanw/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/workmanw/subscriptions","organizations_url":"https://api.github.com/users/workmanw/orgs","repos_url":"https://api.github.com/users/workmanw/repos","events_url":"https://api.github.com/users/workmanw/events{/privacy}","received_events_url":"https://api.github.com/users/workmanw/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2015-08-18T12:09:23Z","updated_at":"2015-08-18T18:04:11Z","closed_at":"2015-08-18T12:48:24Z","body":"I'm not sure if this is a bug or not, but while upgrading our app to 1.13 we noticed a lot of the following warnings:\r\n\r\n>WARNING: Binding style attributes may introduce cross-site scripting vulnerabilities; please ensure that values being bound are properly escaped...\r\n\r\nThe release blog post for Ember 1.11 seemed to suggest that if you used `Ember.String.htmlSafe` you could avoid these warnings. See: [Ember 1.11.0 released (escaping content)](http://emberjs.com/blog/2015/03/27/ember-1-11-0-released.html#toc_escaping-content-in-htmlbars).\r\n\r\nI built this quick JSBin to isolate attribute binding in question: http://emberjs.jsbin.com/xopiho/edit?html,js,console,output\r\n\r\nIt seems like anytime you have a style binding that utilizes string interpolation in the template (eg `<div style=\"width: {{width}}px; height: {{height}}px;\"></div>`), you will receive this warning. \r\n\r\nThe workaround is to just do the interpolation in a computed property and bind the style with: `style={{computedStyleValue}}`, but I was looking for some guidance on if this is a bug on not.\r\n"},"comment":{"url":"https://api.github.com/repos/emberjs/ember.js/issues/comments/132299942","html_url":"https://github.com/emberjs/ember.js/issues/12137#issuecomment-132299942","issue_url":"https://api.github.com/repos/emberjs/ember.js/issues/12137","id":132299942,"user":{"login":"jonathanKingston","id":338988,"avatar_url":"https://avatars.githubusercontent.com/u/338988?v=3","gravatar_id":"","url":"https://api.github.com/users/jonathanKingston","html_url":"https://github.com/jonathanKingston","followers_url":"https://api.github.com/users/jonathanKingston/followers","following_url":"https://api.github.com/users/jonathanKingston/following{/other_user}","gists_url":"https://api.github.com/users/jonathanKingston/gists{/gist_id}","starred_url":"https://api.github.com/users/jonathanKingston/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jonathanKingston/subscriptions","organizations_url":"https://api.github.com/users/jonathanKingston/orgs","repos_url":"https://api.github.com/users/jonathanKingston/repos","events_url":"https://api.github.com/users/jonathanKingston/events{/privacy}","received_events_url":"https://api.github.com/users/jonathanKingston/received_events","type":"User","site_admin":false},"created_at":"2015-08-18T18:04:11Z","updated_at":"2015-08-18T18:04:11Z","body":"@workmanw the hash isn't my focus certainly. As the style usage is so common within Ember addons and React is basically advocating it as a good thing (lets not get into that fight :goberserk:) providing security that works with restrictive CSP policies is my main aim.\r\n\r\nSo yeah I will be working on an RFC however I would rather get it right than have more headaches for the core Ember developers. I'm currently working on a talk for next week about security however I should be free after then to give this the real focus that it needs to get it correct."}}