non-escaping of (raw) attribute values not supported

[loveencounterflow]

using raw 'ꯍ', i can cause a character entity to appear in the output, but when i use raw with an attribute, the value's representation will land outside of the tag (and only the attribute name, not its value is printed).

i think it would be most intuitive to make it so that T.div 'x-foo': 'ꯍ' renders as <div x-foo="&#xabcd;"></div>.

are there any workarounds?

[hurrymaplelad]

Tricky one. Current workaround:

T.raw '<div x-foo="&#xabcd;"></div>'

Don't want all attributes raw by default 'cause it makes script injection easier and makes the common case a href="http://example.com?foo=a&bar=b" render incorrectly.

I'll explore making raw work with attributes. PR welcome.

[hurrymaplelad]

Also, any reason not to use a unicode character instead of an HTML entity?

[hurrymaplelad]

Looks like it'd be straightforward to allow template functions as attribute values. For example:

T.div 'x-foo': -> T.raw 'ꯍ'

Interested?

[chrisfls]

👍