Skip to content

Extension: added getAttributeContexts() for escaping custom attributes as JS, CSS or HTML - #426

Open
vrana wants to merge 2 commits into
nette:masterfrom
vrana:attribute-contexts
Open

vrana wants to merge 2 commits into
nette:masterfrom
vrana:attribute-contexts

Conversation

@vrana

@vrana vrana commented Sep 28, 2026

Copy link
Copy Markdown
Member

@dg

dg commented Oct 28, 2026

Copy link
Copy Markdown
Member

I'd like to take this, with one change in shape: let the built-in contexts be the default entries of the same table instead of the hard-coded checks, i.e. 'on*' => JavaScript, 'style' => Css, 'srcdoc' => Html, and extensions only add to it (overriding a built-in stays an exception). Escaper::enterHtmlAttribute() and classifyAttributeType() then ask one function and the special cases for on*, style and srcdoc disappear. Could you rework it that way and rebase it on master? #425 is merged now.

vrana and others added 2 commits October 29, 2026 07:15
…s as JS, CSS or HTML

An extension can map attribute names, or prefixes ending with *, to
ContentType::JavaScript, Css or Html, e.g. 'x-on:*' => JavaScript or Tippy's
'data-tippy-content' => Html. A registered attribute is then escaped exactly like
on*, style or srcdoc: static values via the Escaper subType, dynamic attributes
(name={$x}) and n:attr via classifyAttributeType(), which now takes the map.
n:attr receives it as a compiled argument only when some context is registered.

Built-in contexts can't be overridden (on*, style, srcdoc and prefixes like s*
are rejected). The map is part of the configuration signature, so extensions
don't have to include it in getCacheKey().

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…tributes as JS, CSS or HTML

The built-in contexts are the default entries of the same table
(HtmlHelpers::AttributeContexts: on*, style, srcdoc) and extensions only add
to it. enterHtmlAttribute() and classifyAttributeType() ask
matchAttributeContext() alone; the hard-coded checks of on*, style and srcdoc
are gone. Overriding a built-in stays an exception.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@vrana
vrana force-pushed the attribute-contexts branch from 3bd7dfa to bdb1f41 Compare October 29, 2026 06:34
@vrana
vrana changed the base branch from srcdoc-escaping to master October 29, 2026 06:34
@vrana

vrana commented Oct 29, 2026

Copy link
Copy Markdown
Member Author

Makes sense, done.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants