escape_gt_in_attrs

[da2x]

Why is there no escape_gt_in_attrs counterpart of escape_lt_in_attrs? Optimistic regex tag-soup readers do negative lookaheads for > to determine the closing point of a tag. They’re just as important to escape in atts as < for compatibility with everything.

Authors can’t work around this because <elm attr="&lt;example&gt;"> is always turned into <elm attr="&lt;example>">

[gsnedders]

escape_lt_in_attrs is needed for some legacy browsers to parse the output correctly (old Gecko and WebKit) when they are unquoted, hence why it exists (and probably should cease to exist as a distinct option once #11 is fixed).

I'm not sure I really want to start adding hacks for regexp parsers given they're almost certainly going to be broken by some reasonable output. Is it anything particularly notable or what is it?

[cjerdonek]

FYI, one more data point on this. I just discovered that html-tidy has a built-in limitation where it will error out if it uncovers more than 10 of the following characters in an attribute value: \n, <, and >. So escaping only left-angle brackets (and even right-angle brackets, too) isn't enough for passing to html-tidy.

Here is the issue I just filed about it: htacg/tidy-html5#542

If it's straightforward to add a custom filter to escape characters like this, I assume that would be enough.

[gsnedders]

Maybe we should make escaping pluggable, though I wonder what the perf cost of that would be… This isn't the first thing it'd help with.

[cjerdonek]

For sure, I think it can be done. It's mainly a question of the API you want and which aspects you want pluggable.

All of the behavior we're discussing in this issue happens in these three lines:

v = v.replace("&", "&")
if self.escape_lt_in_attrs:
    v = v.replace("<", "&lt;")

One possible API would be to have an instance attribute that stores the simple escapes. It could be a list of pairs (old, new) with name and default value like so--

self.attribute_replacements = [
    ("&", "&")
].

Then the three lines up top would become:

for args in self.attribute_replacements:
    v = v.replace(*args)

This approach wouldn't impact performance in any noticeable way.

[gsnedders]

FWIW: my view at this point is adding escape_gt_in_attrs is fine, but someone should write a few tests for it (mostly looking at how it combines with quote_attrs).