Object.keys required for trusted content? about mithril-node-render

[StephanHoyer]

At this point I really don't understand, what i've been done here ;)

I'll look into it.

[StephanHoyer]

Ok, now I figured it out. If I log the result of m.trust('<foo></foo>') i get something like this.

{ '0': '<',
  '1': 'f',
  '2': 'o',
  '3': 'o',
  '4': '>',
  '5': '<',
  '6': '/',
  '7': 'f',
  '8': 'o',
  '9': 'o',
  '10': '>',
  '$trusted': true }

I will try to find out whats happening here.

[StephanHoyer]

turns out I could simply cast to string. That's probably the same thing you did?

[StephanHoyer]

Just found a pretty bad security flaw. Html-content was not quoted.

Maybe you should update your version too.

[ciscoheat]

Yes, I just outputted the trusted value as a string, it worked fine.
Thanks for the security notice, will fix. :)

[StephanHoyer]

Do you have a link to your project?

[ciscoheat]

Yes, it's the same project as the Mithril library for Haxe: https://github.com/ciscoheat/mithril-hx