all repos — gomponents @ 3e9e00ca0dc6b58e58694d84c97a1d2f2ab4002b

HTML components in pure Go

Escape Attr values (#77) Because this can be a place of injection if untrusted data is passed, escape all attribute values. Fixes #74.

Markus Wüstenberg
commit

3e9e00ca0dc6b58e58694d84c97a1d2f2ab4002b

parent

ac7471aac69fcb4e9cd460dae39b0183ec3d10df

1 file changed, 14 insertions(+), 0 deletions(-)

changed files
M gomponents_test.go → gomponents_test.go
@@ -54,6 +54,11 @@ if s != " required" {
 			t.FailNow()
 		}
 	})
+
+	t.Run("escapes attribute values", func(t *testing.T) {
+		a := g.Attr(`id`, `hat"><script`)
+		assert.Equal(t, ` id="hat&#34;&gt;&lt;script"`, a)
+	})
 }
 
 func BenchmarkAttr(b *testing.B) {

@@ -129,6 +134,15 @@ t.Run("returns render error on cannot write", func(t *testing.T) {
 		e := g.El("div")
 		err := e.Render(&erroringWriter{})
 		assert.Error(t, err)
+	})
+}
+
+func BenchmarkEl(b *testing.B) {
+	b.Run("normal elements", func(b *testing.B) {
+		for i := 0; i < b.N; i++ {
+			e := g.El("div")
+			_ = e.Render(&strings.Builder{})
+		}
 	})
 }