{"action":"closed","issue":{"url":"https://api.github.com/repos/segmentio/deku/issues/55","labels_url":"https://api.github.com/repos/segmentio/deku/issues/55/labels{/name}","comments_url":"https://api.github.com/repos/segmentio/deku/issues/55/comments","events_url":"https://api.github.com/repos/segmentio/deku/issues/55/events","html_url":"https://github.com/segmentio/deku/issues/55","id":60903230,"number":55,"title":"Make html escaping the default","user":{"login":"lancejpollard","id":28718,"avatar_url":"https://avatars.githubusercontent.com/u/28718?v=3","gravatar_id":"","url":"https://api.github.com/users/lancejpollard","html_url":"https://github.com/lancejpollard","followers_url":"https://api.github.com/users/lancejpollard/followers","following_url":"https://api.github.com/users/lancejpollard/following{/other_user}","gists_url":"https://api.github.com/users/lancejpollard/gists{/gist_id}","starred_url":"https://api.github.com/users/lancejpollard/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lancejpollard/subscriptions","organizations_url":"https://api.github.com/users/lancejpollard/orgs","repos_url":"https://api.github.com/users/lancejpollard/repos","events_url":"https://api.github.com/users/lancejpollard/events{/privacy}","received_events_url":"https://api.github.com/users/lancejpollard/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2015-03-12T21:10:11Z","updated_at":"2015-03-16T20:01:12Z","closed_at":"2015-03-16T20:01:12Z","body":"It's super easy to forget to escape stuff to prevent XSS attacks. For example, if you allow users to enter some input into a textarea, and then you show that content somewhere in your app outside the textarea (even in multiple places), it's very easy to not realize it needs to be escaped.\r\n\r\nSo it would be a lot safer if it was the default :)\r\n\r\nBasically it takes just using https://github.com/component/escape-html to escape any text node.\r\n\r\n```js\r\ntext = escape(text);\r\n```\r\n\r\nThis will prevent a user from, for example, entering this into a text input:\r\n\r\n```\r\nhello <img src=x onerror=\"alert('i gonna steal yo cookies')\">\r\n```"}}