Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow attribute values to not be escaped #422

Conversation

juanazam
Copy link
Contributor

@juanazam juanazam commented Sep 26, 2022

Oi @philss

Thanks for your hard work on Floki, it's a great package, we use it in production and it works really well!

I found a small issue when using the raw_html function with the encode: false option.
On the app I'm working on, we allow users to configure html blocks programatically using the liquid language. We allow them to use liquid in the content of an HTML tag as well as on the attribute values.

This means that users can end up configuring an element that will look like the following in Floki:

{"a",
 [
   {"href", "{%if 1 > 0 %}\nhttp://www.google.com/\n{%endif%}"},
   {"class", "block-button block-button--solid block-button--sm"},
   {"style",
    "background-color: {{ vars.branding.primary_color | default: default_primary_color }}; border-radius: 6px; color: {{ vars.branding.primary_color_contrast | default: default_primary_color_contrast }};"},
   {"target", "_blank"}
 ], ["\n    A Button \n  "]}

The issue I'm seeing happens when we try to convert elements like the one above into HTML using Floki.raw_html(encode: false). It was my expectation that attribute values wouldn't be encoded/escaped when the encode option was set as false.

As the code stands today, Floki always escapes the values of the attributes.
This PR attempts a very raw implementation of not encoding/escaping the attribute values if the encode option is set to false. So on the example above, the > character always get converted to &gt, which is not the behavior we are aiming for.

I'm very much open to update this implementation in anyway you see fit in order to support a way in which attribute values are left as is.

Again, thanks for taking the time to maintain Floki, and looking forward to your response with guidance on how to proceed with this.

Cheers!

@philss
Copy link
Owner

philss commented Sep 28, 2022

Hola @juanazam 👋

Thank you very much! 💜
And sorry for the delay.

I think this is good to go :shipit:

@philss philss merged commit 2707863 into philss:master Sep 28, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants