Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

refactor: remove class name sanitization, since CSS class names are already HTML attribute escaped #284

Merged
merged 5 commits into from
Nov 11, 2023

Conversation

a-h
Copy link
Owner

@a-h a-h commented Nov 5, 2023

Fixes #211

@gungun974
Copy link
Contributor

This PR is good.
I think it's still good to keep some form of sensitization (even if indirect) for security.

The only concern here I don't see any test testing some TailwindCSS syntax.

In Tailwind for example we use a lot of of closse with - and : like hover:bg-sky-700.
And even sometime thing like text-[#50d71e] or even w-[calc(100%-4rem) with the JIT.

I can suggest to be sure add some complex Class name in the generator test-css-usage tests.

@oliverpool
Copy link

oliverpool commented Nov 7, 2023

I suggest adding the following tests:


templ TailwindClasses() {
	<button class={ "hover:bg-sky-700", "text-[#50d71e]", "w-[calc(100%-4rem)]" }>Tailwind classes</button>
}

templ EscapedClasses() {
	<button class={ "<script>", "\" href=\"#hacked" }>Escaped classes</button>
}

...


	{! TailwindClasses() }
	{! EscapedClasses() }

It seems that the htmldiff.Diff is hiding some escaping.
I added the unescaped HTML to generator/test-css-usage/expected.html

<button class="<script> " href="#hacked">Escaped classes</button>

and the test passes !

However the actually generated HTML is more like

<button class="&lt;script&gt; &#34; href=&#34;#hacked">Escaped classes</button>

I think the bug lies in https://github.com/a-h/htmlformat

 // &lt; & co. gets wrongly removed
htmlformat.Fragment(&buf, strings.NewReader(`<button class="&lt;script&gt; &#34; href=&#34;#hacked">Escaped classes</button>`))

@a-h a-h merged commit 7a905f8 into main Nov 11, 2023
4 checks passed
@a-h a-h deleted the remove_class_name_sanitization_issue_211 branch November 11, 2023 10:04
ross96D pushed a commit to ross96D/templ that referenced this pull request Nov 14, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Can we add an option to disabled SafeClass ?
3 participants