Hi! Thanks for this package.
I've been playing around with it and noticed what looks like it may be an attribute escaping bug, where a string containing a single backslash \ is encoded as a single quote ' instead:
;; with the following require: [huff2.core :as h]
(str (h/html [:input {:value ["\\"]}]))
renders as
Which looks like this:
I believe you're allowed to have an unescaped backslash in an attribute value according to the HTML5 spec for double-quoted attribute values:
Please let me know if you think I've missed something, and thanks again for the package – the syntax, including function components, is very nice!
Update:
(str (h/html [:div "\\"]))
Renders as
So this might be a more general escaping-related bug.
Looks like the issue might be with the following line:
|
(def ^:private char->replacement {\& "&", \< "<", \> ">", \" """, \\ "'"}) |
Backslashes may not need to be escaped in HTML so potentially just removing the last entry from that map would fix the issue. But if there are good reasons to escape backslashes then the ASCII code to use is 92: \.
Hiccup renders the above example as <div>\</div>.
Hi! Thanks for this package.
I've been playing around with it and noticed what looks like it may be an attribute escaping bug, where a string containing a single backslash
\is encoded as a single quote'instead:renders as
Which looks like this:
I believe you're allowed to have an unescaped backslash in an attribute value according to the HTML5 spec for double-quoted attribute values:
Please let me know if you think I've missed something, and thanks again for the package – the syntax, including function components, is very nice!
Update:
Renders as
So this might be a more general escaping-related bug.
Looks like the issue might be with the following line:
huff/src/huff2/core.clj
Line 103 in a5dd251
Backslashes may not need to be escaped in HTML so potentially just removing the last entry from that map would fix the issue. But if there are good reasons to escape backslashes then the ASCII code to use is 92:
\.Hiccup renders the above example as
<div>\</div>.