Documentation
¶
Index ¶
- func AllTests() templ.Component
- func RenderAfterHTMLOpenComment(data string) templ.Component
- func RenderAfterIfCondition(data string) templ.Component
- func RenderAfterNumberWithTrailingDecimalPoint(data string) templ.Component
- func RenderAfterPostfixIncrement(data string) templ.Component
- func RenderAfterPropertyNamedReturn(data string) templ.Component
- func RenderAtRegexpStart(data string) templ.Component
- func RenderAtRegexpStartBeforeQuantifier(data string) templ.Component
- func RenderInRegexp(data string) templ.Component
- func RenderInRegexpAfterHTMLOpenComment(data string) templ.Component
- func RenderInRegexpClass(data string) templ.Component
- func Script[T any](name string, data T) templ.Component
- func ScriptTemplateLiteralSubstitution[T any](name string, data T) templ.Component
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func RenderAfterHTMLOpenComment ¶ added in v0.3.1100
RenderAfterHTMLOpenComment covers <!--, which comments out the rest of the line in a classic script, so the quote after it does not start a string.
func RenderAfterIfCondition ¶ added in v0.3.1100
RenderAfterIfCondition covers a '/' after the condition of an if statement, which starts a regular expression. If the tokenizer reads it as division, the quote in the regular expression is read as the start of a string, and data in code is escaped as string content, so that it executes.
func RenderAfterNumberWithTrailingDecimalPoint ¶ added in v0.3.1100
RenderAfterNumberWithTrailingDecimalPoint covers a '/' after a number that ends with a decimal point, which is division. If the tokenizer reads the '.' as a property access, the '/' starts a regular expression, the quote in the string after it is skipped, and data in code is escaped as string content, so that it executes.
func RenderAfterPostfixIncrement ¶ added in v0.3.1100
RenderAfterPostfixIncrement covers a '/' after a postfix increment, which is division.
func RenderAfterPropertyNamedReturn ¶ added in v0.3.1100
RenderAfterPropertyNamedReturn covers a '/' after a property named return, which is division. If the tokenizer reads it as a regular expression, the quote in the string after it is skipped, and data in code is escaped as string content, so that it executes.
func RenderAtRegexpStart ¶ added in v0.3.1100
RenderAtRegexpStart covers data at the start of a regular expression literal, where empty data would join the opening '/' to the next character.
func RenderAtRegexpStartBeforeQuantifier ¶ added in v0.3.1100
RenderAtRegexpStartBeforeQuantifier covers data at the start of a regular expression literal that is followed by '*', where empty data would start a block comment.
func RenderInRegexp ¶ added in v0.3.1100
RenderInRegexp covers data in a regular expression literal. JSON encoding does not escape '/', so data in a regular expression must be escaped as string content, which escapes '/' and '\', so that it can't end the regular expression.
func RenderInRegexpAfterHTMLOpenComment ¶ added in v0.3.1100
RenderInRegexpAfterHTMLOpenComment covers data in a regular expression after <!--, where a <script> start tag would stop </script> from ending the element.
func RenderInRegexpClass ¶ added in v0.3.1100
RenderInRegexpClass covers data in a character class, where empty data must stay empty, so that no characters are added to the class.
func ScriptTemplateLiteralSubstitution ¶ added in v0.3.1100
ScriptTemplateLiteralSubstitution covers GHSA-jq3r-rjqp-mwgj: a Go expression inside a `${ ... }` substitution of a backtick quoted template literal is in JavaScript expression position, so it must be JSON encoded like any other expression, rather than escaped as string data.
Types ¶
This section is empty.
Source Files