MLstate/opalang — Issue #38: Undesired ability to evaluate JavaScript in event handlers.
Author: akoprow
Created: 2012-02-22 13:06:49+00:00
State: open

The following program allows evaluating JS given as a string.

function page() {

click me

show modal

}
Server.start(Server.http, { title: "test", ~page })

This has been fixed in the classical syntax of Opa, but apparently the error leaked in to the new syntax and needs to be fixed there as well.

Problem originally reported by Alok Menghrajani and subsequently by Johannes Erber.