XSS danger - Escaping needed after #3808

[Conduitry]

This should have its own issue so it's not forgotten about before the next alpha, because this is a nasty one.

No REPL link because this isn't released yet, but:

<div>{'<div onclick="alert(&quot;oh no&quot;)">click me</div>'}</div>

produces an actual div with an onclick since #3808. Less maliciously,

<div>{'&lt;'}</div>

renders as <. The text isn't getting escaped. I don't think there's currently any runtime escaping of entities in DOM code, but with these changes, we'll need some. If this proves too challenging, we should revert #3808 for now.

[tivac]

Runtime escaping wasn't needed when everything was created as a text node. Is the slight code size decrease worth the increased risk and cost of runtime escaping?

Seems like something that needs benchmarking 🤔