markup/goldmark: Exclude event attributes from markdown render hook

Fixes #9511
This commit is contained in:
Joe Mooring 2022-02-16 10:56:23 -08:00 committed by GitHub
parent b2a827c52c
commit ff545f4276
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 40 additions and 3 deletions

View file

@ -20,6 +20,7 @@ import (
"github.com/gohugoio/hugo/hugolib"
)
// Issue 9463
func TestAttributeExclusion(t *testing.T) {
t.Parallel()
@ -55,9 +56,42 @@ foo
).Build()
b.AssertFileContent("public/p1/index.html", `
<h2 class="a" id="heading">
<blockquote class="b">
<div class="highlight" id="c">
<h2 class="a" id="heading">
<blockquote class="b">
<div class="highlight" id="c">
`)
}
// Issue 9511
func TestAttributeExclusionWithRenderHook(t *testing.T) {
t.Parallel()
files := `
-- content/p1.md --
---
title: "p1"
---
## Heading {onclick="alert('renderhook')" data-foo="bar"}
-- layouts/_default/single.html --
{{ .Content }}
-- layouts/_default/_markup/render-heading.html --
<h{{ .Level }}
{{- range $k, $v := .Attributes -}}
{{- printf " %s=%q" $k $v | safeHTMLAttr -}}
{{- end -}}
>{{ .Text | safeHTML }}</h{{ .Level }}>
`
b := hugolib.NewIntegrationTestBuilder(
hugolib.IntegrationTestConfig{
T: t,
TxtarString: files,
NeedsOsFS: false,
},
).Build()
b.AssertFileContent("public/p1/index.html", `
<h2 data-foo="bar" id="heading">Heading</h2>
`)
}

View file

@ -57,6 +57,9 @@ func (a *attributesHolder) Attributes() map[string]string {
a.attributesInit.Do(func() {
a.attributes = make(map[string]string)
for _, attr := range a.astAttributes {
if strings.HasPrefix(string(attr.Name), "on") {
continue
}
a.attributes[string(attr.Name)] = string(util.EscapeHTML(attr.Value.([]byte)))
}
})