Escaping HTML in attribute values about mithril-node-render

[StephanHoyer]

There is no special reason why this is escaped. Just thought it's invalid to not do so. Also I thought there is a security issue not escaping it.

I think at least the quotes have to be escaped.

[codeclown]

Reading the HTML spec, it seems that any character is valid inside attribute values. I'm not sure if that means they should be escaped, though.

That being said, having unescaped double quotes is definitely not valid (assuming double quotes are used for wrapping the value). Somehow I don't like the idea of only escaping double quotes, it seems a bit... hacky. What do you think? Might be better to raise an exception in case of a double quote. In any case, allowing them unescaped by default is probably not a good idea. Escaping is probably most often the expected behaviour, even.

Having this as an option might be the way to go. Even better if it could be defined per element, e.g.

m('div', { id: m.trust('foobar') })

That seems to work okay in Mithril still. It's a bit hacky as well though, since it's not what m.trust was intended for. Introducing some other way (e.g. special properties) is probably a bad idea.

So, I guess my proposal would be to allow it as a universal option, something like this:

render(component, { escapeAttributeValues: false });

Would be great to hear the opinion of someone smarter than me.

[StephanHoyer]

yep. feel free to implement it that way.