Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cannot parse empty attribute #15

Closed
joerdav opened this issue Jun 7, 2021 · 2 comments
Closed

Cannot parse empty attribute #15

joerdav opened this issue Jun 7, 2021 · 2 comments

Comments

@joerdav
Copy link
Collaborator

joerdav commented Jun 7, 2021

nav.templ:

    1 {% package templates %}
    2 
    3 {% import "container/types" %}
    4 
    5 {% templ NavTemplate(apps []types.AppConfig) %}
    6     <nav data-turbo-permanent>       
    7         <h1>{%= "Go Feed Me" %}</h1>
    8         <ul>
    9             {% for _, a := range apps %}
   10                 <li>
   11                     <a href={%= a.Url %}  data-turbo-frame="container">{%= a.Name %}</a>
   12                 </li>
   13             {% endfor %}
   14         </ul>
   15     </nav>
   16 {% endtempl %}

nav_templ.go (it stops after the imports):

>>  1 // Code generated by templ DO NOT EDIT.
    2 
    3 package templates
    4 
>>  5 import "github.com/a-h/templ"
>>  6 import "context"
>>  7 import "io"
>>  8 import "container/types"

Strangely enough this also fails when I try 'data-turbo-permanent="true"' potentially todo with the dashes aswell?

Tried doing a "valueless" attribute without dashes like "hidden". That also resulted in the same outut.

@a-h
Copy link
Owner

a-h commented Jun 7, 2021

Believe it not, it was just that I set the maximum length of an attribute name to 15 characters. I've updated this to 128.

@a-h a-h closed this as completed in 9545078 Jun 7, 2021
@a-h
Copy link
Owner

a-h commented Jun 7, 2021

Wouldn't mind your thoughts on: #16

It would likely break your code above which uses a string:

{%= a.Url %}

This would have to be changed to:

{%= templ.URL(a.URL) %}

This would then ensure that a.URL is sanitised by templ, to remove potential attack vectors from the href attribute. To avoid the extra sanitisation, you'd use templ.SafeURL(a.URL) to mark the variable content as trusted.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants