-
Notifications
You must be signed in to change notification settings - Fork 1.5k
Description
As first laid out in #121 we are facing an issue with what to do with output that contains HTML characters. To quote my initial discussion of this problem
since we are rendering straight to the DOM the
<and>in the typereprget taken as an HTML tag and we still don't get any output. We will have to consider whether to always escape < and > when rendered into the DOM which would unfortunately mean that we cannot have strings be directly interpreted as HTML (e.g. breaking @pzwang's rick-roll demo in the PyCon keynote).
and @fpliger suggested that we could offer an HTML attribute to configure the escaping behavior:
we should provide ways for users to decide what they want to do on 2 levels: the pyscript component level (with an attribute to , and any other element that outputs to the dom. The attribute could be
auto-escapeor something like that) and on the Higher level language level (that users can call directly wrapping their output).