Back

Question about the security of #TaggedTemplateLiterals in #JavaScript. I understand how they are called with literal values separated from interpolations, which you can use to identify hard-coded constants which can't be compromised.

But there's no guarantee a tagged template function is _actually_ called via a tagged template literal right? How is it "safe by construction" if anyone can just pass in any input? Example:

```
html([ '<script>alert("Hacked!");</script>' ])
```

I get that this is harder to pull off in practice because you need a reference to the function itself (`html`), not just an input to it. Definitely a huge improvement, but doesn't entirely eliminate #XSS risk. Is there something else I'm missing here?

Probably @justinfagnani or someone else from #Lit would know the answer to this?