brian_cloudconformity brianlamCC

## ember-xss.md

      
        
          
            
              
              1 file
            
          
          
            
              
              0 forks
            
          
            
              
                
                0 comments
              
            
          
            
              
              0 stars
            
          
        
        
          
              
          
          
            
                brianlamCC
                / ember-xss.md
            
            
              Created
              October 10, 2019 23:55
                — forked from jamesarosen/ember-xss.md
            
              
                Ember and XSS Safety
              
          
        
      
        
  
      
    TL;DR

In Ember, always use {{...}}, not {{{...}}}. Use Ember.String.htmlSafe as necessary in JavaScript (usually in a component)
to mark markup as HTML-safe. Never pass user-entered content directly to Ember.String.htmlSafe.
Details

Ember has great XSS protection built in. The HTMLBars templating library will automatically run any interpolations through
htmlEscape for you. So