Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Possibility use unsafe string #289

Closed
ssimk0 opened this issue Nov 7, 2023 · 2 comments
Closed

Possibility use unsafe string #289

ssimk0 opened this issue Nov 7, 2023 · 2 comments

Comments

@ssimk0
Copy link

ssimk0 commented Nov 7, 2023

Similar to html/template, it would be amazing to be able to render unsafe string ( html template from database for example)

template.HTML("<p>Paragraph</p>")

it will be great to be able do it somehow like :

		<div class="container page">
			<div class="row">
				<div class="col">
					{ templ.UnsafeString(content) }
				</div>
			</div>
		</div>

or there is some way how to do it ?

@a-h
Copy link
Owner

a-h commented Nov 7, 2023

There is a way to do it, it's discussed in #175 (comment)

The question we haven't decided on is whether to include the capability to do it, as per React's dangerouslySetInnerHTML.

In templ, at the moment, all Go strings are classed as "unsafe" and therefore need escaping before output, because it's not possible to identify which Go strings are under the programmer's control.

Since a templ component is just some code that implements the templ.Component interface, it's only a few lines of code to create a non-escaped output component. I was thinking that most people don't and shouldn't need it, so leaving it around is an increased security risk for the wider population who might use it without understanding the implications.

@ssimk0
Copy link
Author

ssimk0 commented Nov 7, 2023

@a-h thanks for pointing me at least :) Hopefully you will include it also to templ with better ergonomics :)

@ssimk0 ssimk0 closed this as completed Nov 7, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants