diff options
| author | bgw <29340584+bgwdotdev@users.noreply.github.com> | 2024-04-25 19:19:15 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2024-04-25 19:19:15 +0100 |
| commit | 93aeeb7a6316389f3bd4bbdb7a9ffc555677e719 (patch) | |
| tree | 70d2443bf31090a320c56b1029d99c0c4bb05dd6 /src | |
| parent | 06b75022eed1e8bbed13a85cc8aeb18199040392 (diff) | |
| download | lustre-93aeeb7a6316389f3bd4bbdb7a9ffc555677e719.tar.gz lustre-93aeeb7a6316389f3bd4bbdb7a9ffc555677e719.zip | |
🔀 Escape attribute values when emitting static HTML. (#113)
* fix: add the escape function over custom attribute values
* fix: update class and style attribute values to be escaped
Diffstat (limited to 'src')
| -rw-r--r-- | src/lustre/internals/vdom.gleam | 33 |
1 files changed, 28 insertions, 5 deletions
diff --git a/src/lustre/internals/vdom.gleam b/src/lustre/internals/vdom.gleam index fc4a4a3..4930f80 100644 --- a/src/lustre/internals/vdom.gleam +++ b/src/lustre/internals/vdom.gleam @@ -282,10 +282,30 @@ fn attributes_to_string_builder( style, inner_html <> val, ) - Ok(#("class", val)) if class == "" -> #(html, val, style, inner_html) - Ok(#("class", val)) -> #(html, class <> " " <> val, style, inner_html) - Ok(#("style", val)) if style == "" -> #(html, class, val, inner_html) - Ok(#("style", val)) -> #(html, class, style <> " " <> val, inner_html) + Ok(#("class", val)) if class == "" -> #( + html, + escape("", val), + style, + inner_html, + ) + Ok(#("class", val)) -> #( + html, + class <> " " <> escape("", val), + style, + inner_html, + ) + Ok(#("style", val)) if style == "" -> #( + html, + class, + escape("", val), + inner_html, + ) + Ok(#("style", val)) -> #( + html, + class, + style <> " " <> escape("", val), + inner_html, + ) Ok(#(key, "")) -> #( string_builder.append(html, " " <> key), class, @@ -293,7 +313,10 @@ fn attributes_to_string_builder( inner_html, ) Ok(#(key, val)) -> #( - string_builder.append(html, " " <> key <> "=\"" <> val <> "\""), + string_builder.append( + html, + " " <> key <> "=\"" <> escape("", val) <> "\"", + ), class, style, inner_html, |