design a safe mechanism for binding markup into a "hole" in a template. about webkit

[ajklein]

What do we mean by "safe" here? If we allow treating a bound string as markup, there's not much safety to be had. Off the top of my head the main safety to be had would be if we allowed binding to some constructed DOM hung off the model (sort of a model-as-template). Or is there something else we can do?

[rafaelw]

Abarth's original plan about this sort of mirrored the approach that ruby
takes which is to allow markup to be evaluated, but limited by a policy in
what constructs can be contained in the markup.

It's possible that this is an orthogonal, but related primitive that we
need to raise. In any case, it seems like it's a requirement that there by
some mechanism for achieving this.

On Wed, Aug 29, 2012 at 10:17 AM, Adam Klein [email protected]:

What do we mean by "safe" here? If we allow treating a bound string as
markup, there's not much safety to be had. Off the top of my head the main
safety to be had would be if we allowed binding to some constructed DOM
hung off the model (sort of a model-as-template). Or is there something
else we can do?

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/9#issuecomment-8133366.

[ajklein]

Ah, right, like "only and tags allowed". Does sound like a primitive missing...