Documentation
¶
Index ¶
- func AnyInsideTemplateLiteral(v any) templ.Component
- func ConstantNameAttributes(value string) templ.Component
- func DynamicAttribute(elementName string, name string, value string) templ.Component
- func SpreadAttribute(elementName string, name string, value string) templ.Component
- func StringInsideDoubleQuotedString(v string) templ.Component
- func StringInsideSingleQuotedString(v string) templ.Component
- func StringInsideTemplateLiteral(v string) templ.Component
- func StringInsideTemplateLiteralSubstitution(v string) templ.Component
- func StringOutsideStringLiteral(v string) templ.Component
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func AnyInsideTemplateLiteral ¶
AnyInsideTemplateLiteral exercises the non-string (JSON marshalled) branch of the template literal escaping path, which the typed string components above don't reach. A non-string value doesn't have a simple round trip to assert on, so this only proves that the script still parses and runs without throwing.
func ConstantNameAttributes ¶
func DynamicAttribute ¶
The components below write a fuzzed attribute name and value through each path that templ uses to render an attribute. The fuzz tests parse the output with an HTML5 parser, the same way that a browser does, and assert that no attribute was added, and that each value is inert. See GHSA-94c2-xg24-pwhv, where a javascript: URL in attributes such as <iframe src> was not sanitized, and a dynamic attribute name could add an event handler.
func SpreadAttribute ¶
func StringOutsideStringLiteral ¶
The five components below each interpolate v into the JavaScript syntax position that one of templruntime's ScriptContent* functions is responsible for escaping, and return it from getValue(). This lets the fuzz test assert a round trip: whatever string goes in must come back out unchanged, proving that no part of it was evaluated as JavaScript along the way rather than treated as inert data. See GHSA-jq3r-rjqp-mwgj, where a value inside a backtick quoted template literal was escaped as an ordinary string, so an embedded "${ ... }" substitution was evaluated as code instead of being reproduced as text.
Types ¶
This section is empty.
Source Files