tstring-html-bindings 0.1.9__tar.gz → 0.2.1__tar.gz

{tstring_html_bindings-0.1.9 → tstring_html_bindings-0.2.1}/Cargo.lock

@@ -290,14 +290,14 @@ checksum = "5d99f8c9a7727884afe522e9bd5edbfc91a3312b36a77b5fb8926e4c31a41801"
 
 [[package]]
 name = "tstring-format-doc"
-version = "0.1.9"
+version = "0.2.1"
 dependencies = [
  "unicode-width",
 ]
 
 [[package]]
 name = "tstring-html"
-version = "0.1.9"
+version = "0.2.1"
 dependencies = [
  "tstring-format-doc",
  "tstring-syntax",
@@ -305,7 +305,7 @@ dependencies = [
 
 [[package]]
 name = "tstring-html-backend-e2e-tests"
-version = "0.1.9"
+version = "0.2.1"
 dependencies = [
  "serde",
  "toml",
@@ -317,7 +317,7 @@ dependencies = [
 
 [[package]]
 name = "tstring-html-bindings"
-version = "0.1.9"
+version = "0.2.1"
 dependencies = [
  "pyo3",
  "tstring-html",
@@ -327,16 +327,16 @@ dependencies = [
 
 [[package]]
 name = "tstring-syntax"
-version = "0.2.1"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ad566997891426a640b07af2330b9c08ad04e918f905880885d78a21304d9ee"
+checksum = "2e6021e5e8f36304512dedeb70fce2c8f75a37eb6d823d1747b02e31c5fadd75"
 dependencies = [
  "num-bigint",
 ]
 
 [[package]]
 name = "tstring-tdom"
-version = "0.1.9"
+version = "0.2.1"
 dependencies = [
  "tstring-format-doc",
  "tstring-syntax",
@@ -344,7 +344,7 @@ dependencies = [
 
 [[package]]
 name = "tstring-thtml"
-version = "0.1.9"
+version = "0.2.1"
 dependencies = [
  "tstring-html",
  "tstring-syntax",

{tstring_html_bindings-0.1.9 → tstring_html_bindings-0.2.1}/Cargo.toml

@@ -9,9 +9,9 @@ homepage = "https://github.com/koxudaxi/tstring-html"
 license = "MIT"
 repository = "https://github.com/koxudaxi/tstring-html"
 rust-version = "1.94.0"
-version = "0.1.9"
+version = "0.2.1"
 
 [workspace.dependencies]
 pyo3 = "0.27.1"
-tstring-syntax = { version = "=0.2.1" }
+tstring-syntax = { version = "0.2.2" }
 unicode-width = "0.2.2"

{tstring_html_bindings-0.1.9 → tstring_html_bindings-0.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tstring-html-bindings
-Version: 0.1.9
+Version: 0.2.1
 Classifier: Development Status :: 4 - Beta
 Classifier: Intended Audience :: Developers
 Classifier: License :: OSI Approved :: MIT License

{tstring_html_bindings-0.1.9 → tstring_html_bindings-0.2.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "tstring-html-bindings"
-version = "0.1.9"
+version = "0.2.1"
 description = "Native Python bindings for tstring-html"
 readme = "README.md"
 license = { text = "MIT" }

{tstring_html_bindings-0.1.9 → tstring_html_bindings-0.2.1}/tstring-html-bindings/Cargo.toml

@@ -19,8 +19,8 @@ extension-module = ["pyo3/extension-module"]
 
 [dependencies]
 pyo3 = { workspace = true, features = ["abi3-py314"] }
-tstring-html = { version = "0.1.9", path = "../tstring-html-rs" }
-tstring-thtml = { version = "0.1.9", path = "../tstring-thtml-rs" }
+tstring-html = { version = "0.2.1", path = "../tstring-html-rs" }
+tstring-thtml = { version = "0.2.1", path = "../tstring-thtml-rs" }
 tstring-syntax.workspace = true
 
 [dev-dependencies]

{tstring_html_bindings-0.1.9 → tstring_html_bindings-0.2.1}/tstring-html-bindings/src/lib.rs

@@ -1,7 +1,7 @@
 use pyo3::create_exception;
 use pyo3::exceptions::{PyException, PyTypeError};
 use pyo3::prelude::*;
-use pyo3::types::{PyAny, PyBool, PyDict, PyIterator, PyModule};
+use pyo3::types::{PyAny, PyBool, PyByteArray, PyBytes, PyDict, PyIterator, PyModule};
 use std::collections::{HashMap, VecDeque};
 use std::sync::{Arc, Mutex, MutexGuard, OnceLock};
 use tstring_html::{
@@ -178,12 +178,14 @@ struct PyCompiledThtmlTemplate {
 #[pymethods]
 impl PyCompiledHtmlTemplate {
     fn render(&self, py: Python<'_>, values: Vec<Py<PyAny>>) -> PyResult<String> {
-        let context = runtime_context_from_values(py, &values)?;
+        let context =
+            runtime_context_from_values_for_document(py, &values, self.compiled.document())?;
         render_html_compiled(self.compiled.as_ref(), &context).map_err(backend_error_to_py)
     }
 
     fn render_fragment(&self, py: Python<'_>, values: Vec<Py<PyAny>>) -> PyResult<String> {
-        let context = runtime_context_from_values(py, &values)?;
+        let context =
+            runtime_context_from_values_for_document(py, &values, self.compiled.document())?;
         Ok(
             tstring_html::render_fragment(self.compiled.as_ref(), &context)
                 .map_err(backend_error_to_py)?
@@ -214,7 +216,8 @@ impl PyCompiledThtmlTemplate {
             registry,
             "CompiledThtmlTemplate.render",
         )?;
-        let context = runtime_context_from_values(py, &values)?;
+        let context =
+            runtime_context_from_values_for_document(py, &values, self.compiled.document())?;
         render_thtml_document(
             py,
             self.compiled.document(),
@@ -235,6 +238,20 @@ struct BoundTemplate {
     values: Vec<Py<PyAny>>,
 }
 
+#[derive(Clone, Debug)]
+struct InterpolationFormatting {
+    interpolation_index: usize,
+    expression: String,
+    conversion: Option<String>,
+    format_spec: String,
+}
+
+impl InterpolationFormatting {
+    fn needs_formatting(&self) -> bool {
+        self.conversion.is_some() || !self.format_spec.is_empty()
+    }
+}
+
 impl BoundTemplate {
     fn cache_key_strings(&self) -> &[String] {
         &self.strings
@@ -368,14 +385,22 @@ fn runtime_value_from_py(py: Python<'_>, value: &Bound<'_, PyAny>) -> PyResult<R
     if value.is_none() {
         return Ok(RuntimeValue::Null);
     }
-    if let Ok(marker) = value.getattr("__tstring_renderable__") {
-        if marker.is_truthy()? {
-            let rendered = value.call_method0("render")?;
-            let rendered: String = rendered
-                .extract()
-                .map_err(|_| runtime_error_to_py("Renderable.render() must return a string."))?;
-            return Ok(RuntimeValue::RawHtml(rendered));
-        }
+    if is_template_value(value)? {
+        return Err(runtime_error_to_py(
+            "Template values cannot be rendered directly; wrap them with html() or thtml().",
+        ));
+    }
+    if is_binary_value(value) {
+        return Err(runtime_error_to_py(
+            "bytes and bytearray values cannot be rendered.",
+        ));
+    }
+    if is_renderable_value(value)? {
+        let rendered = value.call_method0("render")?;
+        let rendered: String = rendered
+            .extract()
+            .map_err(|_| runtime_error_to_py("Renderable.render() must return a string."))?;
+        return Ok(RuntimeValue::RawHtml(rendered));
     }
     if let Ok(raw) = value.extract::<bool>() {
         return Ok(RuntimeValue::Bool(raw));
@@ -417,19 +442,234 @@ fn runtime_value_from_py(py: Python<'_>, value: &Bound<'_, PyAny>) -> PyResult<R
 }
 
 fn runtime_context_from_bound(py: Python<'_>, bound: &BoundTemplate) -> PyResult<RuntimeContext> {
-    runtime_context_from_values(py, &bound.values)
+    runtime_context_from_values_with_formatting(
+        py,
+        &bound.values,
+        collect_input_formatting(&bound.input),
+    )
+}
+
+fn runtime_context_from_values_for_document(
+    py: Python<'_>,
+    values: &[Py<PyAny>],
+    document: &Document,
+) -> PyResult<RuntimeContext> {
+    runtime_context_from_values_with_formatting(py, values, collect_document_formatting(document))
 }
 
-fn runtime_context_from_values(py: Python<'_>, values: &[Py<PyAny>]) -> PyResult<RuntimeContext> {
+fn runtime_context_from_values_with_formatting(
+    py: Python<'_>,
+    values: &[Py<PyAny>],
+    formatting: Vec<InterpolationFormatting>,
+) -> PyResult<RuntimeContext> {
+    let mut formatting_by_index = vec![None; values.len()];
+    for item in formatting {
+        if !item.needs_formatting() {
+            continue;
+        }
+        if let Some(slot) = formatting_by_index.get_mut(item.interpolation_index) {
+            if slot.is_none() {
+                *slot = Some(item);
+            }
+        }
+    }
+
     let mut runtime_values = Vec::with_capacity(values.len());
-    for value in values {
-        runtime_values.push(runtime_value_from_py(py, value.bind(py))?);
+    for (index, value) in values.iter().enumerate() {
+        let formatted = match formatting_by_index.get(index).and_then(Option::as_ref) {
+            Some(formatting) => apply_interpolation_formatting(py, value.bind(py), formatting)?,
+            None => value.clone_ref(py),
+        };
+        runtime_values.push(runtime_value_from_py(py, formatted.bind(py))?);
     }
     Ok(RuntimeContext {
         values: runtime_values,
     })
 }
 
+fn collect_input_formatting(input: &TemplateInput) -> Vec<InterpolationFormatting> {
+    input
+        .segments
+        .iter()
+        .filter_map(|segment| match segment {
+            tstring_syntax::TemplateSegment::Interpolation(interpolation) => {
+                Some(formatting_from_template_interpolation(interpolation))
+            }
+            tstring_syntax::TemplateSegment::StaticText(_) => None,
+        })
+        .collect()
+}
+
+fn collect_document_formatting(document: &Document) -> Vec<InterpolationFormatting> {
+    let mut formatting = Vec::new();
+    collect_node_formatting(&document.children, &mut formatting);
+    formatting
+}
+
+fn collect_node_formatting(nodes: &[Node], formatting: &mut Vec<InterpolationFormatting>) {
+    for node in nodes {
+        match node {
+            Node::Fragment(fragment) => collect_node_formatting(&fragment.children, formatting),
+            Node::Element(element) => {
+                collect_attribute_formatting(&element.attributes, formatting);
+                collect_node_formatting(&element.children, formatting);
+            }
+            Node::ComponentTag(component) => {
+                collect_attribute_formatting(&component.attributes, formatting);
+                collect_node_formatting(&component.children, formatting);
+            }
+            Node::RawTextElement(element) => {
+                collect_attribute_formatting(&element.attributes, formatting);
+                collect_node_formatting(&element.children, formatting);
+            }
+            Node::Interpolation(interpolation) => {
+                formatting.push(formatting_from_node_interpolation(interpolation));
+            }
+            Node::Text(_) | Node::Comment(_) | Node::Doctype(_) => {}
+        }
+    }
+}
+
+fn collect_attribute_formatting(
+    attributes: &[AttributeLike],
+    formatting: &mut Vec<InterpolationFormatting>,
+) {
+    for attribute in attributes {
+        match attribute {
+            AttributeLike::Attribute(attribute) => {
+                if let Some(value) = &attribute.value {
+                    for part in &value.parts {
+                        if let tstring_html::ValuePart::Interpolation(interpolation) = part {
+                            formatting.push(formatting_from_node_interpolation(interpolation));
+                        }
+                    }
+                }
+            }
+            AttributeLike::SpreadAttribute(attribute) => {
+                formatting.push(formatting_from_node_interpolation(&attribute.interpolation));
+            }
+        }
+    }
+}
+
+fn formatting_from_template_interpolation(
+    interpolation: &TemplateInterpolation,
+) -> InterpolationFormatting {
+    InterpolationFormatting {
+        interpolation_index: interpolation.interpolation_index,
+        expression: interpolation.expression.clone(),
+        conversion: interpolation.conversion.clone(),
+        format_spec: interpolation.format_spec.clone(),
+    }
+}
+
+fn formatting_from_node_interpolation(
+    interpolation: &tstring_html::InterpolationNode,
+) -> InterpolationFormatting {
+    InterpolationFormatting {
+        interpolation_index: interpolation.interpolation_index,
+        expression: interpolation.expression.clone(),
+        conversion: interpolation.conversion.clone(),
+        format_spec: interpolation.format_spec.clone(),
+    }
+}
+
+fn apply_interpolation_formatting(
+    py: Python<'_>,
+    value: &Bound<'_, PyAny>,
+    formatting: &InterpolationFormatting,
+) -> PyResult<Py<PyAny>> {
+    if is_structural_format_value(value)? {
+        return Err(runtime_error_to_py(format!(
+            "Interpolation '{}' uses conversion or format_spec on a structured value.",
+            formatting.expression
+        )));
+    }
+
+    let mut current = match formatting.conversion.as_deref() {
+        None => value.clone().unbind(),
+        Some("r") => value
+            .repr()
+            .map_err(|err| formatting_runtime_error("repr", formatting, err))?
+            .unbind()
+            .into_any(),
+        Some("s") => value
+            .str()
+            .map_err(|err| formatting_runtime_error("str", formatting, err))?
+            .unbind()
+            .into_any(),
+        Some("a") => py
+            .import("builtins")?
+            .getattr("ascii")?
+            .call1((value,))
+            .map_err(|err| formatting_runtime_error("ascii", formatting, err))?
+            .unbind(),
+        Some(conversion) => {
+            return Err(runtime_error_to_py(format!(
+                "Unsupported conversion !{conversion} for interpolation '{}'.",
+                formatting.expression
+            )));
+        }
+    };
+
+    if formatting.format_spec.is_empty() {
+        return Ok(current);
+    }
+
+    current = current
+        .bind(py)
+        .call_method1("__format__", (formatting.format_spec.as_str(),))
+        .map_err(|err| formatting_runtime_error("format", formatting, err))?
+        .unbind();
+    Ok(current)
+}
+
+fn formatting_runtime_error(
+    operation: &str,
+    formatting: &InterpolationFormatting,
+    err: PyErr,
+) -> PyErr {
+    runtime_error_to_py(format!(
+        "Failed to apply {operation} for interpolation '{}': {err}",
+        formatting.expression
+    ))
+}
+
+fn is_structural_format_value(value: &Bound<'_, PyAny>) -> PyResult<bool> {
+    if is_template_value(value)? || is_binary_value(value) || is_renderable_value(value)? {
+        return Ok(true);
+    }
+    if value.extract::<PyRef<'_, RawHtml>>().is_ok()
+        || value.extract::<PyRef<'_, Fragment>>().is_ok()
+        || value.cast::<PyDict>().is_ok()
+    {
+        return Ok(true);
+    }
+    if value.extract::<String>().is_ok() {
+        return Ok(false);
+    }
+    Ok(PyIterator::from_object(value).is_ok())
+}
+
+fn is_renderable_value(value: &Bound<'_, PyAny>) -> PyResult<bool> {
+    match value.getattr("__tstring_renderable__") {
+        Ok(marker) => marker.is_truthy(),
+        Err(_) => Ok(false),
+    }
+}
+
+fn is_template_value(value: &Bound<'_, PyAny>) -> PyResult<bool> {
+    if value.get_type().name()? != "Template" {
+        return Ok(false);
+    }
+    let module: String = value.get_type().getattr("__module__")?.extract()?;
+    Ok(module == "string.templatelib")
+}
+
+fn is_binary_value(value: &Bound<'_, PyAny>) -> bool {
+    value.cast::<PyBytes>().is_ok() || value.cast::<PyByteArray>().is_ok()
+}
+
 fn registry_to_scope_dict<'py>(
     py: Python<'py>,
     registry: &Bound<'py, PyAny>,
@@ -614,6 +854,11 @@ fn render_thtml_node(
                         };
                         if let RuntimeValue::Attributes(entries) = value {
                             for (key, value) in entries {
+                                if !tstring_html::is_valid_html_attribute_name(key) {
+                                    return Err(runtime_error_to_py(format!(
+                                        "Spread attribute name {key:?} is not a valid HTML attribute name."
+                                    )));
+                                }
                                 kwargs.set_item(key, python_from_runtime_value(py, value)?)?;
                             }
                         } else {
@@ -695,7 +940,7 @@ fn render_thtml_node(
             out.push_str("-->");
         }
         Node::Doctype(doctype) => {
-            out.push_str("<!DOCTYPE ");
+            out.push_str("<!");
             out.push_str(&doctype.value);
             out.push('>');
         }
@@ -711,11 +956,17 @@ fn render_thtml_node(
 fn render_escaped_text_value(value: &RuntimeValue, out: &mut String) -> Result<(), BackendError> {
     match value {
         RuntimeValue::Null => {}
-        RuntimeValue::Bool(value) => out.push_str(&escape_html_text(&value.to_string())),
-        RuntimeValue::Int(value) => out.push_str(&escape_html_text(&value.to_string())),
-        RuntimeValue::Float(value) => out.push_str(&escape_html_text(&value.to_string())),
-        RuntimeValue::String(value) => out.push_str(&escape_html_text(value)),
-        RuntimeValue::RawHtml(value) => out.push_str(&escape_html_text(value)),
+        RuntimeValue::Bool(value) => {
+            out.push_str(&tstring_html::escape_html_text(&value.to_string()))
+        }
+        RuntimeValue::Int(value) => {
+            out.push_str(&tstring_html::escape_html_text(&value.to_string()))
+        }
+        RuntimeValue::Float(value) => {
+            out.push_str(&tstring_html::escape_html_text(&value.to_string()))
+        }
+        RuntimeValue::String(value) => out.push_str(&tstring_html::escape_html_text(value)),
+        RuntimeValue::RawHtml(value) => out.push_str(&tstring_html::escape_html_text(value)),
         RuntimeValue::Fragment(values) | RuntimeValue::Sequence(values) => {
             for value in values {
                 render_escaped_text_value(value, out)?;
@@ -732,19 +983,6 @@ fn render_escaped_text_value(value: &RuntimeValue, out: &mut String) -> Result<(
     Ok(())
 }
 
-fn escape_html_text(value: &str) -> String {
-    let mut escaped = String::with_capacity(value.len());
-    for ch in value.chars() {
-        match ch {
-            '&' => escaped.push_str("&amp;"),
-            '<' => escaped.push_str("&lt;"),
-            '>' => escaped.push_str("&gt;"),
-            _ => escaped.push(ch),
-        }
-    }
-    escaped
-}
-
 fn render_attribute_value_for_component(
     py: Python<'_>,
     value: &tstring_html::AttributeValue,

{tstring_html_bindings-0.1.9 → tstring_html_bindings-0.2.1}/tstring-html-rs/Cargo.toml

@@ -9,5 +9,5 @@ rust-version.workspace = true
 version.workspace = true
 
 [dependencies]
-tstring-format-doc = { version = "0.1.5", path = "../tstring-format-doc-rs" }
+tstring-format-doc = { version = "0.2.1", path = "../tstring-format-doc-rs" }
 tstring-syntax.workspace = true

{tstring_html_bindings-0.1.9 → tstring_html_bindings-0.2.1}/tstring-html-rs/src/formatter.rs

@@ -159,14 +159,15 @@ fn build_attribute(attribute: &Attribute) -> Doc {
         return Doc::text(attribute.name.clone());
     };
 
-    let mut parts = vec![Doc::text(format!("{}=\"", attribute.name))];
+    let quote = attribute_quote(value);
+    let mut parts = vec![Doc::text(format!("{}={quote}", attribute.name))];
     for part in &value.parts {
         parts.push(match part {
-            ValuePart::Text(text) => Doc::text(escape_attribute_text(text)),
+            ValuePart::Text(text) => Doc::text(escape_attribute_text(text, quote)),
             ValuePart::Interpolation(interpolation) => build_interpolation(interpolation),
         });
     }
-    parts.push(Doc::text("\""));
+    parts.push(Doc::text(quote.to_string()));
     Doc::concat(parts)
 }
 
@@ -218,8 +219,25 @@ fn is_mixed_content(children: &[Node]) -> bool {
     })
 }
 
-fn escape_attribute_text(text: &str) -> String {
-    text.replace('"', """)
+fn attribute_quote(value: &crate::AttributeValue) -> char {
+    let mut has_single = false;
+    let mut has_double = false;
+    for part in &value.parts {
+        let ValuePart::Text(text) = part else {
+            continue;
+        };
+        has_single |= text.contains('\'');
+        has_double |= text.contains('"');
+    }
+    if has_double && !has_single { '\'' } else { '"' }
+}
+
+fn escape_attribute_text(text: &str, quote: char) -> String {
+    match quote {
+        '"' => text.replace('"', """),
+        '\'' => text.replace('\'', "'"),
+        _ => text.to_string(),
+    }
 }
 
 fn is_void_html_tag(name: &str) -> bool {

{tstring_html_bindings-0.1.9 → tstring_html_bindings-0.2.1}/tstring-html-rs/src/lib.rs

@@ -983,6 +983,13 @@ fn validate_attributes(attributes: &[AttributeLike]) -> BackendResult<()> {
                             attribute.span.clone(),
                         ));
                     }
+                    if let Some(static_value) = static_attribute_value(value) {
+                        reject_dangerous_url_attribute_value(
+                            &attribute.name,
+                            &static_value,
+                            attribute.span.clone(),
+                        )?;
+                    }
                 }
             }
             AttributeLike::SpreadAttribute(_) => {}
@@ -1193,13 +1200,22 @@ fn render_attribute(
                     RuntimeValue::Null => Ok(None),
                     RuntimeValue::Bool(false) => Ok(None),
                     RuntimeValue::Bool(true) => Ok(Some(None)),
-                    other => Ok(Some(Some(escape_html_attribute(&stringify_runtime_value(
-                        &other,
-                    )?)))),
+                    other => {
+                        let raw = stringify_runtime_value(other)?;
+                        Ok(Some(Some(escape_html_attribute_value(
+                            &attribute.name,
+                            &raw,
+                            attribute.span.clone(),
+                        )?)))
+                    }
                 };
             }
             let rendered = render_attribute_value_string(value, context, &attribute.name)?;
-            Ok(Some(Some(escape_html_attribute(&rendered))))
+            Ok(Some(Some(escape_html_attribute_value(
+                &attribute.name,
+                &rendered,
+                attribute.span.clone(),
+            )?)))
         }
     }
 }
@@ -1212,37 +1228,51 @@ fn apply_spread_attribute(
     match value_for_interpolation(context, &attribute.interpolation)? {
         RuntimeValue::Attributes(entries) => {
             for (name, value) in entries {
-                if name == "class" {
-                    normalized.saw_class = true;
-                    if !normalized.order.iter().any(|entry| entry == "class") {
-                        normalized.order.push("class".to_string());
-                    }
-                    normalized
-                        .class_values
-                        .extend(normalize_class_value(&value)?);
-                    continue;
+                if !is_valid_html_attribute_name(&name) {
+                    return Err(runtime_error(
+                        "html.runtime.spread_name",
+                        format!(
+                            "Spread attribute name {name:?} is not a valid HTML attribute name."
+                        ),
+                        attribute.span.clone(),
+                    ));
                 }
-                match value {
-                    RuntimeValue::Null | RuntimeValue::Bool(false) => {
-                        normalized.attrs.remove(name.as_str());
-                    }
-                    RuntimeValue::Bool(true) => {
-                        if !normalized.order.iter().any(|entry| entry == name) {
-                            normalized.order.push(name.clone());
+
+                match name.as_str() {
+                    "class" => {
+                        normalized.saw_class = true;
+                        if !normalized.order.iter().any(|entry| entry == "class") {
+                            normalized.order.push("class".to_string());
                         }
-                        normalized.attrs.insert(name.clone(), None);
+                        normalized
+                            .class_values
+                            .extend(normalize_class_value(&value)?);
                     }
-                    other => {
-                        if !normalized.order.iter().any(|entry| entry == name) {
-                            normalized.order.push(name.clone());
+                    _ => match value {
+                        RuntimeValue::Null | RuntimeValue::Bool(false) => {
+                            normalized.attrs.remove(name.as_str());
                         }
-                        normalized.attrs.insert(
-                            name.clone(),
-                            Some(escape_html_attribute(&stringify_runtime_value_impl(
-                                &other,
-                            )?)),
-                        );
-                    }
+                        RuntimeValue::Bool(true) => {
+                            if !normalized.order.iter().any(|entry| entry == name) {
+                                normalized.order.push(name.clone());
+                            }
+                            normalized.attrs.insert(name.clone(), None);
+                        }
+                        other => {
+                            if !normalized.order.iter().any(|entry| entry == name) {
+                                normalized.order.push(name.clone());
+                            }
+                            let raw = stringify_runtime_value_impl(other)?;
+                            normalized.attrs.insert(
+                                name.clone(),
+                                Some(escape_html_attribute_value(
+                                    &name,
+                                    &raw,
+                                    attribute.span.clone(),
+                                )?),
+                            );
+                        }
+                    },
                 }
             }
             Ok(())
@@ -1472,93 +1502,104 @@ fn stringify_runtime_value_impl(value: &RuntimeValue) -> BackendResult<String> {
     }
 }
 
-fn escape_html_text(value: &str) -> String {
-    value
-        .replace('&', "&amp;")
-        .replace('<', "&lt;")
-        .replace('>', "&gt;")
+#[must_use]
+pub fn escape_html_text(value: &str) -> String {
+    escape_html(value, false)
 }
 
-fn escape_html_attribute(value: &str) -> String {
-    let mut out = String::new();
-    let mut index = 0usize;
+#[must_use]
+pub fn escape_html_attribute(value: &str) -> String {
+    escape_html(value, true)
+}
 
-    while index < value.len() {
-        let ch = value[index..]
-            .chars()
-            .next()
-            .expect("valid character boundary");
+fn escape_html(value: &str, escape_quote: bool) -> String {
+    let mut out = String::with_capacity(value.len());
+    for ch in value.chars() {
         match ch {
-            '&' => {
-                if let Some(entity_len) = html_entity_len(&value[index..]) {
-                    out.push_str(&value[index..index + entity_len]);
-                    index += entity_len;
-                } else {
-                    out.push_str("&amp;");
-                    index += 1;
-                }
-            }
-            '<' => {
-                out.push_str("&lt;");
-                index += 1;
-            }
-            '>' => {
-                out.push_str("&gt;");
-                index += 1;
-            }
-            '"' => {
-                out.push_str("&quot;");
-                index += 1;
-            }
-            _ => {
-                out.push(ch);
-                index += ch.len_utf8();
-            }
+            '&' => out.push_str("&amp;"),
+            '<' => out.push_str("&lt;"),
+            '>' => out.push_str("&gt;"),
+            '"' if escape_quote => out.push_str("&quot;"),
+            _ => out.push(ch),
         }
     }
-
     out
 }
 
-fn html_entity_len(input: &str) -> Option<usize> {
-    let bytes = input.as_bytes();
-    if !bytes.starts_with(b"&") {
-        return None;
-    }
-
-    let mut index = 1usize;
-    if bytes.get(index) == Some(&b'#') {
-        index += 1;
-        if matches!(bytes.get(index), Some(b'x' | b'X')) {
-            index += 1;
-            let start = index;
-            while bytes.get(index).is_some_and(u8::is_ascii_hexdigit) {
-                index += 1;
-            }
-            if index == start || bytes.get(index) != Some(&b';') {
-                return None;
-            }
-            return Some(index + 1);
-        }
+fn escape_html_attribute_value(
+    name: &str,
+    value: &str,
+    span: Option<SourceSpan>,
+) -> BackendResult<String> {
+    reject_dangerous_url_attribute_value(name, value, span)?;
+    Ok(escape_html_attribute(value))
+}
 
-        let start = index;
-        while bytes.get(index).is_some_and(u8::is_ascii_digit) {
-            index += 1;
-        }
-        if index == start || bytes.get(index) != Some(&b';') {
-            return None;
+fn static_attribute_value(value: &AttributeValue) -> Option<String> {
+    let mut rendered = String::new();
+    for part in &value.parts {
+        match part {
+            ValuePart::Text(text) => rendered.push_str(text),
+            ValuePart::Interpolation(_) => return None,
         }
-        return Some(index + 1);
     }
+    Some(rendered)
+}
 
-    let start = index;
-    while bytes.get(index).is_some_and(u8::is_ascii_alphanumeric) {
-        index += 1;
+fn reject_dangerous_url_attribute_value(
+    name: &str,
+    value: &str,
+    span: Option<SourceSpan>,
+) -> BackendResult<()> {
+    if !is_url_attribute_name(name) {
+        return Ok(());
     }
-    if index == start || bytes.get(index) != Some(&b';') {
-        return None;
+    let Some(scheme) = dangerous_url_scheme(value) else {
+        return Ok(());
+    };
+    Err(runtime_error(
+        "html.runtime.url_scheme",
+        format!("URL attribute '{name}' cannot use the unsafe {scheme} scheme."),
+        span,
+    ))
+}
+
+fn is_url_attribute_name(name: &str) -> bool {
+    const URL_ATTRIBUTE_NAMES: &[&str] = &[
+        "href",
+        "src",
+        "action",
+        "formaction",
+        "xlink:href",
+        "cite",
+        "poster",
+        "background",
+        "manifest",
+    ];
+    URL_ATTRIBUTE_NAMES
+        .iter()
+        .any(|attribute| name.eq_ignore_ascii_case(attribute))
+}
+
+fn dangerous_url_scheme(value: &str) -> Option<&'static str> {
+    let mut normalized = String::with_capacity(value.len().min("javascript:".len()));
+    for ch in value.chars() {
+        if ch.is_control() || ch.is_whitespace() {
+            continue;
+        }
+        normalized.push(ch.to_ascii_lowercase());
+        match normalized.as_str() {
+            "data:" => return Some("data:"),
+            "vbscript:" => return Some("vbscript:"),
+            "javascript:" => return Some("javascript:"),
+            candidate
+                if "data:".starts_with(candidate)
+                    || "vbscript:".starts_with(candidate)
+                    || "javascript:".starts_with(candidate) => {}
+            _ => return None,
+        }
     }
-    Some(index + 1)
+    None
 }
 
 fn flatten_input(template: &TemplateInput) -> Vec<StreamItem> {
@@ -1605,6 +1646,14 @@ fn is_name_char(value: char, is_start: bool) -> bool {
     }
 }
 
+pub fn is_valid_html_attribute_name(name: &str) -> bool {
+    let mut chars = name.chars();
+    let Some(first) = chars.next() else {
+        return false;
+    };
+    is_name_char(first, true) && chars.all(|ch| is_name_char(ch, false))
+}
+
 fn parse_error(
     code: impl Into<String>,
     message: impl Into<String>,
@@ -1742,6 +1791,34 @@ mod tests {
         assert_eq!(rendered, "<title>&lt;safe&gt;</title>");
     }
 
+    #[test]
+    fn unsafe_static_url_attributes_are_rejected_during_check() {
+        let input = TemplateInput::from_segments(vec![TemplateSegment::StaticText(
+            "<a href=\"java\n script:alert(1)\">x</a>".to_string(),
+        )]);
+        let err = check_template(&input).expect_err("unsafe URL scheme must fail");
+        assert_eq!(err.kind, ErrorKind::Semantic);
+        assert!(err.message.contains("unsafe javascript:"));
+    }
+
+    #[test]
+    fn attribute_escaping_always_escapes_ampersands() {
+        let input = TemplateInput::from_segments(vec![
+            TemplateSegment::StaticText("<div title=\"".to_string()),
+            interpolation(0, "title", Some("{title}")),
+            TemplateSegment::StaticText("\"></div>".to_string()),
+        ]);
+        let compiled = compile_template(&input).expect("compile html template");
+        let rendered = render_html(
+            &compiled,
+            &RuntimeContext {
+                values: vec![RuntimeValue::String("safe &amp; sound".to_string())],
+            },
+        )
+        .expect("render html");
+        assert_eq!(rendered, "<div title=\"safe &amp;amp; sound\"></div>");
+    }
+
     #[test]
     fn script_interpolation_is_still_rejected() {
         let input = TemplateInput::from_segments(vec![

{tstring_html_bindings-0.1.9 → tstring_html_bindings-0.2.1}/tstring-thtml-rs/Cargo.toml

@@ -9,5 +9,5 @@ rust-version.workspace = true
 version.workspace = true
 
 [dependencies]
-tstring-html = { version = "0.1.9", path = "../tstring-html-rs" }
+tstring-html = { version = "0.2.1", path = "../tstring-html-rs" }
 tstring-syntax.workspace = true