Documentation
¶
Overview ¶
Package htmlattr classifies HTML attributes by the escaping and sanitization that their values require. The generator uses it for attributes with constant names, and the runtime uses it for attributes with dynamic names, and spread attributes, so that both apply the same rules.
See GHSA-94c2-xg24-pwhv, where only a fixed list of lowercase attribute names was sanitized, so values in attributes such as <iframe src>, <button formaction>, and <a HREF> could execute JavaScript.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func IsAnimationTargetURL ¶
IsAnimationTargetURL returns true if the value of an SVG animation element's attributeName attribute may be an attribute that contains a URL.
Browsers may ignore whitespace around the name, and a namespace prefix other than xlink may refer to the XLink namespace, so IsAnimationTargetURL trims HTML whitespace, and returns true for a href attribute with any prefix.
func IsValidName ¶
IsValidName returns true if the name can be written as an HTML attribute name without changing the structure of the element. It rejects empty names, and names that contain whitespace, control characters, quotes, the characters that end an attribute name, or an ampersand, because browsers do not decode character references in attribute names.
html/template's htmlNameFilter is stricter: it only allows ASCII letters and digits, so it rejects common names such as data-testid.
Types ¶
type Context ¶
type Context int
Context describes the position that an attribute value is written into, which determines how the value must be escaped and sanitized.
const ( // ContextDefault values are HTML-escaped. ContextDefault Context = iota // ContextURL values are URLs. Values are sanitized with templ.URL. ContextURL // ContextEventHandler values are executed as JavaScript by the browser, or // by htmx. Values must be a templ.ComponentScript. ContextEventHandler // ContextSrcdoc values are parsed as an HTML document in the context of the // page. String values are escaped as text. ContextSrcdoc // ContextAnimationValue values are SVG animation values, which can set the // href of the parent element to a javascript: URL. Each item in the // semicolon separated list is sanitized with templ.URL. ContextAnimationValue // ContextStyle values are CSS. ContextStyle // ContextSrcset values are comma separated lists of image candidates, each a // URL followed by optional descriptors. The URL of each candidate is sanitized // with templ.URL. ContextSrcset )
func Classify ¶
Classify returns the context of the value of the attribute on the element.
HTML element and attribute names are case insensitive, so Classify lowercases both names before comparing them. Browsers only lowercase the ASCII letters in names, so Classify does the same.
URL attributes are classified in the same way as html/template's attrType, i.e. by attribute name on any element, including data-* attributes and custom attributes whose names contain "src", "uri", or "url".
An empty element name means that the element is unknown, so the SVG animation value rules apply.
Source Files