# label element with for attribute # CSS via elm-css
# lazy and non-lazy versions render the same output <script></script> is unsafe in JSON unless it is escaped properly.<script></script> is unsafe in JSON unless it is escaped properly. # lazy nodes as direct children of keyed nodes # lazy nested within keyed nodes # invalid element name is skipped # invalid attributes are skipped, both string and boolean
# attribute values are escaped
# class attribute values are escaped (it is special cased)
# style attribute values are escaped (it is special cased)
# attribute values cannot introduce another attribute
# text is escaped <script>true && alert(0)</script> # children of void elements are skipped # script tags are changed to p tags by the virtual-dom package

0 < 1 && alert(0)

# style tags are allowed, and contain raw text