refactor: demonstrate how URL schemes are restricted unless templ.Saf…

…eURL is used

generator/test-attribute-escaping/render_test.go

@@ -0,0 +1,24 @@
+package testhtml
+
+import (
+	"context"
+	"strings"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+)
+
+const expected = `<div>` +
+	`<a href="about:invalid#TemplFailedSanitizationURL"` +
+	`</div>`
+
+func TestHTML(t *testing.T) {
+	w := new(strings.Builder)
+	err := BasicTemplate(`javascript: alert("xss");`).Render(context.Background(), w)
+	if err != nil {
+		t.Errorf("failed to render: %v", err)
+	}
+	if diff := cmp.Diff(expected, w.String()); diff != "" {
+		t.Error(diff)
+	}
+}

generator/test-attribute-escaping/template.templ

@@ -0,0 +1,8 @@
+{% package testhtml %}
+
+{% templ BasicTemplate(url string) %}
+  <div>
+	  <a href={%= templ.URL(url) %}>{%= "text" %}</a>
+  </div>
+{% endtempl %}
+