pebble icon indicating copy to clipboard operation
pebble copied to clipboard

Pebble Autoescape doesn't work when using in tag atribute

Open cdxf opened this issue 5 years ago • 1 comments

For example, when using it in title atributte:

<div title="{{ title }}">content</div>

For example, it won't escapse if title = foo\"><script src="//xss.mx"><\/script><x=\

cdxf avatar Jun 22 '20 15:06 cdxf

Strange. It works for me. <div title="foo\&quot;&gt;&lt;script src=&quot;//xss.mx&quot;&gt;&lt;\/script&gt;&lt;x=\">content</div>

ogrammer avatar Jan 19 '21 19:01 ogrammer