GrugandMaurits van Riezen 30e5bdcf3a Escape toast text by default, add html option (#203) ...

Toast title, description and action labels were inserted into the page
as HTML, so passing user input could inject markup or script. They are
now escaped by default, and `html: true` keeps the old raw-HTML
behaviour. The action href, onclick strings, category and duration are
escaped as attribute values. `icon` stays raw markup.

Documents the `html` and `icon` options, adds a warning about `html`
and `onclick`, and notes that the Jinja and Nunjucks macros rely on
template autoescaping.

Co-authored-by: Maurits van Riezen <12109031+mousetail@users.noreply.github.com>

2026-10-23 09:23:05 +08:00

..

css

Fix iOS auto-zoom on combobox input (#185)

2026-10-22 23:32:56 +08:00

js

Escape toast text by default, add html option (#203)

2026-10-23 09:23:05 +08:00

templates

Don't close dialogs when a drag ends on the backdrop (#202)

2026-10-23 09:22:42 +08:00