/Wiki/sources/honojs__hono/2026/https-hono-dev-llms-full-txt-security-5ad6955be1cd-security-s0704-c0000.md
Security - hono-docs
Security Source evidence: /Sources/raw/honojs hono/honojs hono.md Canonical citation: https://hono.dev/llms full.txt security Summary The CSS helpers are CSS...
Security
Source evidence: /Sources/raw/honojshono/honojshono.md Canonical citation: https://hono.dev/llms-full.txt#security
Summary
The CSS helpers are CSS-authoring APIs: like other CSS-in-JS libraries, interpolated values are inserted as raw CSS. They block breaking out into HTML (quotes, backslashes, and </), but {, }, and ; pass through since they are...
Content
The CSS helpers are CSS-authoring APIs: like other CSS-in-JS libraries, interpolated values are inserted as raw CSS. They block breaking out into HTML (quotes, backslashes, and </), but {, }, and ; pass through since they are valid CSS.
::: warning
Treat the CSS helpers like other raw sinks (html, raw, rawCssString): don't pass untrusted input into them directly. Doing so allows CSS injection. Validate against an allowlist first.
const ALLOWED_COLORS = ['red', 'green', 'blue']
const color = ALLOWED_COLORS.includes(input) ? input : 'black'
const headerClass = css`
color: ${color};
`:::
Kinic Wiki