Skip to content

[fix]: parse obj in attrs #4

Open

Description

@voischev

input

<button class="button button_theme_alfa-on-white button_view_extra button_size_l button_type_submit button__control i-bem button_js_inited" data-bem="{&quot;button&quot;:{&quot;checkedView&quot;:&quot;extra&quot;}}" role="button" type="submit"><span class="button__text">Войти в интернет</span></button>

output

<button class="button button_theme_alfa-on-white button_view_extra button_size_l button_type_submit button__control i-bem" data-bem="{" button":{"checkedview":"extra"}}"="" role="button" type="submit"><span class="button__text">Войти в интернет</span></button>

Activity

  1. self-assigned this
    on Dec 11, 2017
  2. changed the title [-]parse obj in attrs[/-] [+][fix]: parse obj in attrs[/+] on Dec 11, 2017
  3. added this to the 1.0.7 milestone on Dec 11, 2017
  4. ccorcos commented on Jan 2, 2018

    @ccorcos

    I can verify this.

  5. ccorcos commented on Jan 2, 2018

    @ccorcos

    If you use v0.2.1 it works. This commit introduced the issue: posthtml/posthtml-parser@7e32484

  6. Scrum commented on Jan 4, 2018

    @Scrum
    Member

    v0.2.1

    may be v3.1 ?

    If you use v0.2.1 it works.

    Yes it works but maybe I hurried up. it probably does not need to be parsed but it's only necessary to transform it with the renderer and all this should most likely be options

  7. ccorcos commented on Jan 4, 2018

    @ccorcos

    Sounds like it needs to not be parsed. It shouldn't be unescaping those quotes and creating invalid html...

  8. modified the milestones: 1.0.7, 1.0.8, on Jan 18, 2018
  9. RReverser commented on Aug 9, 2018

    @RReverser

    Not sure if the same issue, but currently PostHTML transforms HTML like

    <img src='1" onload="alert()'>

    into

    <img src="1" onerror="alert()">

    which creates security issues when executed on untrusted HTML.

  10. modified the milestones: 1.1.2, 1.1.6 on May 6, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

Type

No type

Projects

No projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions