htmlio

func AppendAttr ¶ added in v0.406.0

func AppendAttr(b []byte, name, value string) []byte

AppendAttr appends a trusted attribute name with an escaped value.

The name parameter is written verbatim with no escaping or validation and MUST NOT be derived from untrusted data, or it becomes an HTML-injection primitive. The value parameter must be unescaped and is encoded by AppendAttrValue.

func AppendAttrValue ¶ added in v0.406.0

func AppendAttrValue(b []byte, value string) []byte

AppendAttrValue appends value as a double-quoted HTML attribute value.

The value must be unescaped. It is escaped for HTML source, with carriage returns emitted as 
 and U+0000 replaced by U+FFFD. Use Attr or AppendAttr to build a complete attribute.

func AppendAttrs ¶ added in v0.500.0

func AppendAttrs(b []byte, attrs []template.HTMLAttr) []byte

AppendAttrs appends each non-empty attribute fragment in attrs to b, each prefixed with a single space so the result can be concatenated directly after a tag name.

The attrs are trusted raw HTML attribute fragments written verbatim with no escaping; they MUST NOT contain untrusted data. Use Attr or AppendAttr to build attribute fragments with an escaped value.

func Attr ¶ added in v0.406.0

func Attr(name, value string) template.HTMLAttr

Attr returns a trusted attribute name with an escaped value.

The name parameter is written verbatim with no escaping or validation and MUST NOT be derived from untrusted data, or it becomes an HTML-injection primitive. The value parameter must be unescaped and is encoded by AppendAttrValue.

func WriteHTMLInner ¶

func WriteHTMLInner(w io.Writer, jid jid.Jid, htmlTag, typeAttr string, innerHTML template.HTML, attrs ...template.HTMLAttr) (err error)

WriteHTMLInner writes an HTML element with trusted inner HTML.

Void elements such as img and input are written without a closing tag, and any innerHTML passed for them is ignored, since a void element cannot contain content (emitting "<img>...</img>" would be invalid HTML).

Unlike WriteHTMLTag it emits no value attribute; pass one via attrs (for example Attr("value", v)) when a value="..." is needed.

For textarea and pre elements, the HTML source includes one LF immediately after the start tag. The parser strips that one LF, so a leading LF in innerHTML is preserved instead of being consumed.

Carriage returns in innerHTML are written verbatim. Browsers normalize them to LF in textarea values. Use AppendAttrValue for attribute values that must retain carriage returns.

The htmlTag parameter is trusted and written verbatim with no escaping or validation; it MUST NOT be derived from untrusted data. The typeAttr parameter must be unescaped and is encoded by AppendAttrValue. The attrs parameter contains trusted raw attribute fragments and is written verbatim with no escaping; it MUST NOT contain untrusted data. Use Attr or AppendAttr to build attribute fragments with an escaped value.

package main

import (
	"fmt"
	"html/template"
	"strings"

	"github.com/linkdata/jaws/lib/htmlio"
	"github.com/linkdata/jaws/lib/jid"
)

func main() {
	userText := `<b onclick="alert(1)">Ada & Bob</b>`
	safeInner := template.HTML(template.HTMLEscapeString(userText)) // #nosec G203

	var sb strings.Builder
	if err := htmlio.WriteHTMLInner(&sb, jid.Jid(7), "span", "", safeInner, htmlio.Attr("title", userText)); err != nil {
		panic(err)
	}
	fmt.Println(sb.String())

}

Output:
<span id="Jid.7" title="&lt;b onclick=&#34;alert(1)&#34;&gt;Ada &amp; Bob&lt;/b&gt;">&lt;b onclick=&#34;alert(1)&#34;&gt;Ada &amp; Bob&lt;/b&gt;</span>

func WriteHTMLInput ¶

func WriteHTMLInput(w io.Writer, jid jid.Jid, typeAttr, valueAttr string, attrs []template.HTMLAttr) (err error)

WriteHTMLInput writes an input start tag with optional id, type, value and raw attribute fragments. The id attribute is emitted only for a positive jid.Jid.

The typeAttr and valueAttr parameters must be unescaped and are encoded by AppendAttrValue. The attrs parameter contains trusted raw attribute fragments and is written verbatim with no escaping; it MUST NOT contain untrusted data. Use Attr or AppendAttr to build attribute fragments with an escaped value.

func WriteHTMLTag ¶

func WriteHTMLTag(w io.Writer, jid jid.Jid, htmlTag, typeAttr, valueAttr string, attrs []template.HTMLAttr) (err error)

WriteHTMLTag writes an HTML start tag with optional id, type, value and raw attribute fragments.

The htmlTag parameter is trusted and written verbatim with no escaping or validation; it MUST NOT be derived from untrusted data. The typeAttr and valueAttr parameters must be unescaped and are encoded by AppendAttrValue. The attrs parameter contains trusted raw attribute fragments and is written verbatim with no escaping; it MUST NOT contain untrusted data. Use Attr or AppendAttr to build attribute fragments with an escaped value.