Distinguish text content from HTML content

[jaredkrinke]

In templates, is there any way to distinguish plain text content from HTML content? Or does the caller need to always escape arbitrary text values?

As a contrived example, in the docs under the "Event" header, if I type <b>bold! into the text box, bold text appears, so it seems I can insert arbitrary HTML. That's fine for hard-coded values, but seems like a security issue for anything derived from user input.

For what it's worth, I like the minimal, modern JS-based approach of ArrowJS, but this seems like a potential footgun :)

[justin-schroeder]

Yeah, this 100% isn't supposed to happen. should be doing an innerText assignment for some reason it isnt, but that should be fairly easy to get fixed I think.