From 3e9e00ca0dc6b58e58694d84c97a1d2f2ab4002b Mon Sep 17 00:00:00 2001
From: Markus Wüstenberg
Date: Tue, 18 May 2021 14:21:53 +0200
Subject: Escape Attr values (#77)

Because this can be a place of injection if untrusted data is passed, escape all attribute values.

Fixes #74.---
 gomponents_test.go | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

(limited to 'gomponents_test.go')

diff --git a/gomponents_test.go b/gomponents_test.go
index c88a796..dffa64c 100644
--- a/gomponents_test.go
+++ b/gomponents_test.go
@@ -54,6 +54,11 @@ func TestAttr(t *testing.T) {
 			t.FailNow()
 		}
 	})
+
+	t.Run("escapes attribute values", func(t *testing.T) {
+		a := g.Attr(`id`, `hat"><script`)
+		assert.Equal(t, ` id="hat&#34;&gt;&lt;script"`, a)
+	})
 }
 
 func BenchmarkAttr(b *testing.B) {
@@ -132,6 +137,15 @@ func TestEl(t *testing.T) {
 	})
 }
 
+func BenchmarkEl(b *testing.B) {
+	b.Run("normal elements", func(b *testing.B) {
+		for i := 0; i < b.N; i++ {
+			e := g.El("div")
+			_ = e.Render(&strings.Builder{})
+		}
+	})
+}
+
 type erroringWriter struct{}
 
 func (w *erroringWriter) Write(p []byte) (n int, err error) {
-- 
cgit 1.4.1