Consider `escape`ing argument keys and values to prevent XSS in some scenarios

[gcollazo]

Thanks for this package. I built a very similar project in TypeScript a few years ago, having completions and types makes a big difference.

I've been trying the package and noticed that there's no escapeing of attributes keys or values. On some scenarios you might need to take user input and present it as attribute keys or values.

For example:

>>> # this is ok
>>> user_input = "red"
>>> div({"class": user_input})
<div class="red"></div>

>>> # this is xss
>>> user_input = '" onmouseenter="alert(1)" noop="'
>>> div({"class": user_input})
<div class="" onmouseenter="alert(1)" noop=""></div>

>>> # this is xss
>>> user_input = 'onmouseenter="alert(1)" noop'
>>> div({user_input: "1"})
<div onmouseenter="alert(1)" noop="1"></div>

I suggest escapeing both attribute keys and values to prevent this. On my testing I've tried the following which has successfully prevented the issue.

>>> # this is ok
>>> user_input = '" onmouseenter="alert(1)" noop="'
>>> div({"class": escape(user_input)})
<div class="&quot; onmouseenter=&quot;alert(1)&quot; noop=&quot;"></div>

On the key side of attributes simple escapeing works at least on my basic tests but I would throw a few additional replacements that I've seen on other libraries to be on the safe side.

>>> # this is ok
>>> user_input = 'onmousenter="alert(1)" noop'
>>> div({escape(user_input): "1"})
<div onmousenter=&quot;alert(1)&quot; noop="1"></div>

>>> # this is more ok?
>>> def escape_attr_key(key: str) -> str:
    return (
        escape(key)
        .replace("=", "=")
        .replace("\\", "\")
        .replace("`", "`")
    )
>>> user_input = 'onmousenter="alert(1)" noop'
>>> div({escape_attr_key(user_input): "1"})
<div onmousenter&#x3D;&quot;alert(1)&quot; noop="1"></div>

What do you think?

[keithasaurus]

Thanks for bringing this up! I think it's probably worth escaping as you've outlined.

[gcollazo]

If you give me the green light I can try making a PR during the week.

[keithasaurus]

@gcollazo I had some time to get this done, and I'd rather get it done now, so I did it. If you have time to look at the PR, I'd be grateful, but no pressure.

Big thanks for making such a clear case for this! I had thought it was too much of an edge case to worry about before.