WIP: Closes #21: Safer fields (escaping fields in xhtm)

[aral]

Escapes fields (interpolated strings)

See #21 for a more detailed explanation of the reasoning behind it.

[aral]

I’m testing this in Kitten at the moment and I’m not entirely sure I’m going to go with it. Will update this thread with the implications I find for authoring, etc. Please treat this PR as a work-in-progress for the time being.

[aral]

Right, so the problem with this is that I can’t see any way of not escaping text content (e.g., for those times when we actually want to render sanitised HTML).

With vhtml, you can have dangerouslySetInnerHTML as an attribute as it’s aware of attributes. But, unless I’m missing something, we’re not at the stage where we set the field content. Sending some sort of a flag within the field content itself, of course, wouldn’t work as that would be exploit itself.

Hmm…