Hacker News Reader

That looks like more XSS vectors.

Also what do I do if I want to fire analytics even and open the modal. Correct, use onClick.

> That looks like more XSS vectors.

Could you elaborate on that? I don't understand how this leads to more XSS vectors.

If these are proposals to use bindings between html attributes and calling JS methods, then it's enough to inject HTML, not JS, to start executing JS.

It’s not executing JS. The names map to JS methods but both the HTML and JS call into C++ (or rust or swift whatever the browser is written in). Arbitrary JS code execution cannot occur. Of course if you’re ingesting user generated content you should not allow these attributes on buttons (but for proper security you should already have an allow-list of tags and attributes on any user generated content).

Reply on news.ycombinator.com