Context-aware escaping

[DemiMarie]

This is necessary to be able to safely e.g., have colors for elements that are determined at runtime. It is also necessary to support proper URL handling.

[Stebalien]

Can you give me some concrete examples? The current escaping should be sufficient for HTML text nodes and HTML attributes (the scope of horrorshow).

[DemiMarie]

https://security.googleblog.com/2009/03/reducing-xss-by-way-of-automatic.html

So dynamically-chosen colors and URLs.

[Stebalien]

I see. Those issues are well beyond the scope of horrorshow. Basically, horrorshow-level escaping prevents potentially user-specified strings from messing with the HTML document's structure but nothing more.