google / google/safehtml

Can safehtml support custom attributes like one that HTMX requires?

Open
#11 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
380
Forks
23
PR merge metrics
No merged PRs in 30d

Description

I started a personal web project and decided to use this package rather than the default `html/template` as it seems like a responsible thing to do, but I am running into an error that I cannot get around without forking the package:

```
html/template:my.template.html: cannot escape action {{.Url}}: actions
must not occur in the "hx-get" attribute value context of a "li" element
```

From reading the code is seems that you have hardcoded all potential element-attribute combinations into `elementSpecificAttrValSanitizationContext` and `globalAttrValSanitizationContext`/`elementContentSanitizationContext` and thus the `hx-get` attribute is disallowed, right?

Is there any reason why it would be unsafe to add a method that allows adding attributes to be considered valid, assuming they are adding using string literals passed to the method that would add them?

If not, seems like a really easy enhancement I could add and create a PR for? Would that be something you would consider allowing?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.