Re: E4H and constructing DOMs

On Mar 9, 2013, at 6:26 PM, Brendan Eich <brendan@secure.meer.net> wrote:

> Allen Wirfs-Brock wrote:
>> On Mar 9, 2013, at 5:29 PM, Brendan Eich wrote:
>>> No, the idea Ojan put forth is that the tag-less form should call a default handler other than String, in browsers. Specifically it would do a checked form of HTML parsing that threw if interpolations were not complete and well-formed subtrees. 
>> 
>> Platform specific processing for tag-less string templates would be terrible for cross platform interoperability.
> 
> You mean portability.

I think Ojan's proposal was to have *no* tag-less string templates, which wouldn't have a portability issue.

Another possibility is to have no tag-less string templates in the core language, but add them only for the browser-hosted binding, pointing to an AST-based HTML template that returns a DOM tree.

I suspect that even for many non-browser-hosted applications of JS, string templating with a very convenient syntax would be a security footgun. I would expect this to be true for Node.js, certainly.

Regards,
Maciej