luckyframework / luckyframework/lucky
HTML attributes that aren't pre-escaped?
Open
@mdwagner is already working on this.
Since Aug 28, 2023.
bug
- Dominant language
- Crystal
- Stars
- 2.7k
- Forks
- 172
- PR merge metrics
- No merged PRs in 30d
Description
When using LuckyHTML, I've noticed you don't need to run HTML.escape, as it does this for you behind the scenes (#9). Normally, this would make sense to do on everything: both text and attributes.
However, if you're using something like htmx for your client-server interactions, there are situations where the attributes shouldn't be pre-escaped.
As an example, this
becomes this
which is undesirable (and broken).
We could provide a new tag method that will not escape attributes (you can already do unescaped text with the raw tag helper), but idk if anyone has any other ideas.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.