SEC-002: raw HTML from data

Warning: the page still builds, but this is most likely a mistake.

raw writes HTML without escaping it. With data in it, whoever wrote that data can put a <script> on the page: if a review or a name comes from a visitor, that's cross-site scripting.

Fails

page(title: "Shoes", description: "All our running shoes, from light racers to trail shoes.") {
  props(review: Review)
  h1 "Shoes"
  raw "{review.text}"
}

warning[SEC-002]: raw HTML from data isn't escaped
 --> page.hypra:4:7
  |
4 |   raw "{review.text}"
  |       ^^^^^^^^^^^^^^^
  = help: only use trusted HTML here; p "{...}" escapes it
  = docs: https://hypralang.dev/rules/sec-002/

0 errors, 1 warning

Fixed

page(title: "Shoes", description: "All our running shoes, from light racers to trail shoes.") {
  props(review: Review, post: Post)
  h1 "Shoes"
  p "{review.text}"
  allow("SEC-002") "the post is our own Markdown, rendered and sanitized when it's saved"
  raw "{post.html}"
}

Text in p "{...}" is escaped, so it shows exactly as written. HTML you trust gets allow with the reason.