XSS in Svelte {@html}: Safe Patterns and Fixes
Svelte’s {@html} is one of those features that feels harmless right up until it isn’t. It solves a real problem: sometimes you need to render trusted HTML. CMS content, rich text, server-generated markup, documentation snippets, email previews — all valid use cases. But {@html} is also the fastest way to turn a Svelte app into an XSS delivery mechanism if you feed it untrusted input. This guide is the practical version: what’s dangerous, what actually works, and what I’d ship. ...