google / google/safehtml

safe identifier characters should include all Unicode alphanumerics

Open
#4 0 comments 1 reaction 0 assignees View on GitHub
Dominant language
Go
Stars
380
Forks
23
PR merge metrics
No merged PRs in 30d

Description

The documentation for safe identifiers says "alphanumeric" characters are allowed, but the implementation supports only ASCII letters and numbers. Unless there are security issues with Unicode characters, they should be supported.

Motivation: documentation sites that want to use language identifiers as (part of) fragments for easy navigation, e.g. https://pkg.go.dev.

The change I'm suggesting would be from
```
var onlyAlphanumericsOrHyphenPattern = regexp.MustCompile(`^[-_a-zA-Z0-9]*$`)
```
(https://github.com/google/safehtml/blob/v0.0.2/identifier.go#L49)
to
```
var onlyAlphanumericsOrHyphenPattern = regexp.MustCompile(`^[-_\pL\pN]*$`)
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.