Escape expressions in @Html #767

Merged

KitaitiMakoto merged 1 commits from html-escape into master

KitaitiMakoto commented (Migrated from github.com)

I found "use your Fediverse account" link at https://plume.nixnet.xyz/~/BlogOwl/why-i-don't-have-a-personal-website is broken. This is because URI in HTML attributes is not escaped.

I know characters which need to be escaped is not allow in user name, so escape(&uri!(user::details: name = &author.fqn).to_string()), might be unnecessary. But escaping all expressions in HTML template is web application basis. For instance, in the future, special chars in user name might get allowed and at the time this link will be broken.

I found "use your Fediverse account" link at https://plume.nixnet.xyz/~/BlogOwl/why-i-don't-have-a-personal-website is broken. This is because URI in HTML attributes is not escaped. I know characters which need to be escaped is not allow in user name, so `escape(&uri!(user::details: name = &author.fqn).to_string()),` might be unnecessary. But escaping all expressions in HTML template is web application basis. For instance, in the future, special chars in user name might get allowed and at the time this link will be broken.

codecov[bot] commented (Migrated from github.com)

Codecov Report

Merging #767 into master will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##           master     #767   +/-   ##
=======================================
  Coverage   38.99%   38.99%           
=======================================
  Files          73       73           
  Lines        9721     9721           
  Branches     2226     2226           
=======================================
  Hits         3791     3791           
  Misses       4878     4878           
  Partials     1052     1052

# [Codecov](https://codecov.io/gh/Plume-org/Plume/pull/767?src=pr&el=h1) Report > Merging [#767](https://codecov.io/gh/Plume-org/Plume/pull/767?src=pr&el=desc) into [master](https://codecov.io/gh/Plume-org/Plume/commit/847d6f7fac57e18b9b3bf7ac0f64bc461883841d&el=desc) will **not change** coverage. > The diff coverage is `n/a`. ```diff @@ Coverage Diff @@ ## master #767 +/- ## ======================================= Coverage 38.99% 38.99% ======================================= Files 73 73 Lines 9721 9721 Branches 2226 2226 ======================================= Hits 3791 3791 Misses 4878 4878 Partials 1052 1052 ```

elegaanz (Migrated from github.com) approved these changes

elegaanz (Migrated from github.com) left a comment

Seems reasonable indeed. 👍

Seems reasonable indeed. :+1:

KitaitiMakoto commented (Migrated from github.com)

Thank you!

kiwii referenced this issue from a commit

Escape expressions in @Html (#767)

Reviewers

The pull request has been merged as dabe904642.

You can also view command line instructions.

Step 1:

From your project repository, check out a new branch and test the changes.

git checkout -b html-escape master

git pull origin html-escape

Step 2:

Merge the changes and update on Forgejo.

git checkout master

git merge --no-ff html-escape

git push origin master

No reviewers

No Milestone

No Assignees

1 Participants

Notifications

Due Date

The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Loading…

There is no content yet.

Labels Milestones

Escape expressions in @Html #767

Codecov Report

Reviewers

Step 1:

Step 2: