| HN Mirror

Y	Hacker News new \| ask \| show \| jobs


	by ycmbntrthrwaway 2962 days ago
	It should have been done via DOM manipulation in the first place. What Signal developers did can be compared to constructing raw SQL requests where parameterized queries suffice. Thankfully, it was just fixed: https://github.com/signalapp/Signal-Desktop/commit/4e5c8965f...

1 comments

Frankly, I'm not to eager to trust people writing commit messages like this and then OK that during peer review:

> Remove escaping from `linkText` > We leverage jQuery’s HTML escaping in `$.html(…)`.

ummm.... wat