Skip to content

Preserve quote style when rendering markup content #33548

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 6 commits into from
Jun 15, 2021

Conversation

captainsafia
Copy link
Member

Fixes #20950.

When a component renders static markup like:

<input onfocus='alert(""Test"");' />
<input onfocus=""alert(""Test"");"" />
<input onfocus=""alert('Test');"" />
<p data-options='{direction: ""fromtop"", animation_duration: 25, direction: ""reverse""}'></p>

The Razor compiler interprets this collection of lines as a MarkupBlock. Unlike tag helper attributes, we don't store any information about what type of quote is used in the attributes (typically represented with an AttributeStructure enum). Instead, we indiscriminately use double quotes for all attributes on an HTML element within a markup block.

Builder.Append("=\"");
// Visit Children
base.VisitDefault(node);
Builder.Append('"');

This causes issues in particular if a markup element like <input onfocus='alert("Test");' /> is rendered because we produce the incorrectly quoted <input onfocus="alert("Test");" />. To resolve this, we add a check when constructing the attribute string to preserve the original quote style designated by the user.

@captainsafia captainsafia requested a review from Pilchie as a code owner June 15, 2021 14:35
@ghost ghost added the area-mvc Includes: MVC, Actions and Controllers, Localization, CORS, most templates label Jun 15, 2021
@captainsafia captainsafia added area-razor.compiler and removed area-mvc Includes: MVC, Actions and Controllers, Localization, CORS, most templates labels Jun 15, 2021
@captainsafia captainsafia requested review from NTaylorMullen and SteveSandersonMS and removed request for Pilchie June 15, 2021 14:36
Copy link
Member

@SteveSandersonMS SteveSandersonMS left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks great!

@captainsafia captainsafia merged commit ef19746 into main Jun 15, 2021
@captainsafia captainsafia deleted the safia/fix-razor-compiler-quotation branch June 15, 2021 18:29
@ghost ghost added this to the 6.0-preview6 milestone Jun 15, 2021
@phlexpay
Copy link

data-hs-header-options='{
"fixMoment": 0,
"fixEffect": "slide"
}'

this as an attribute on a normal html element (in this case

) is still causing problems. The content is coming up as null when I try to get the string from the attribute.

@ghost
Copy link

ghost commented Aug 25, 2022

Hi @phlexpay. It looks like you just commented on a closed PR. The team will most probably miss it. If you'd like to bring something important up to their attention, consider filing a new issue and add enough details to build context.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Razor compiler produces incorrect markup content for single-quoted attributes
4 participants