[w3c/webcomponents] [templates] Contextual auto-escaping (#711)

With the removal of `replaceHTML()`, and if `replace()` performs escaping like setting `textContent` the design of template system should be fairly secure (pending actual security reviews).

One place it could be better is by adding contextual auto-escaping to prevent user-provided values from executing script when used in dangerous attributes, like with:

```html
<a href="{{url}}">{{title}}</a>
```

```js
template.createInstance({
  url: 'javascript:alert("hi")',
  title: 'XSS',
});
```


-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/webcomponents/issues/711