Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Using Render trait for element and attribute names makes it easy to generate invalid HTML #29

Open
utkarshkukreti opened this issue Mar 28, 2023 · 1 comment

Comments

@utkarshkukreti
Copy link
Owner

Follow up to #28, which has been fixed now.

markup::define! {
    A { $"/" {} }
    B { div["=" = "c"] {} }
}

fn main() {
    println!("{}", A {});
    println!("{}", B {});
}

prints:

</><//>
<div =="c"></div>

This one is more tricky to fix since element and attribute names cannot be just escaped - they have a set of valid characters.

Element names: ref

Tags contain a tag name, giving the element's name. HTML elements all have names that only use ASCII alphanumerics. In the HTML syntax, tag names, even those for foreign elements, may be written with any mix of lower- and uppercase letters that, when converted to all-lowercase, matches the element's tag name; tag names are case-insensitive.

But this does not include custom elements, I'll have to check.

Attribute names: ref

Attributes have a name and a value. Attribute names must consist of one or more characters other than controls, U+0020 SPACE, U+0022 ("), U+0027 ('), U+003E (>), U+002F (/), U+003D (=), and noncharacters. In the HTML syntax, attribute names, even those for foreign elements, may be written with any mix of ASCII lower and ASCII upper alphas.


There could be two ways to implement this check:

  1. Return an error on encountering an invalid element or attribute name.
  2. Strip invalid characters from element and attribute names. (But the remaining characters may still not be a valid name if the original name only consists of invalid characters.)

I'm leaning towards (1) after I figure out what characters exactly are allowed in element names.

@utkarshkukreti
Copy link
Owner Author

(In these two cases, where the invalid value is a literal, this should be a compile error. The runtime error would be when the element or attribute name is from a runtime value.)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant