blaze-html
blaze-html copied to clipboard
Published
20 hours ago •
jaspervdj
jaspervdj
Incorrect encoding of href attribute values
Consider the following code:
{-# LANGUAGE OverloadedStrings #-}
module Test where
import Text.Blaze.Html5 as H
import Text.Blaze.Html5.Attributes as A
import Text.Blaze.Html.Renderer.Pretty
example =
putStr $ renderHtml $ docTypeHtml $ do
H.head $ do
meta ! charset "utf-8"
H.title "Test"
body $ do
a ! A.href "#%41" $ "Link"
a ! A.id "A" $ "Wrong target"
a ! A.id "%41" $ "Correct target"
The resulting output:
<!DOCTYPE HTML>
<html>
<head>
<meta charset="utf-8">
<title>
Test
</title>
</head>
<body>
<a href="#%41">
Link
</a>
<a id="A">
Wrong target
</a>
<a id="%41">
Correct target
</a>
</body>
</html>
Note that the href attribute value is not properly encoded, it should be #%2541. The value #%41 is interpreted as a link to A, not as a link to %41.
Is the user of blaze-html expected to perform this encoding manually? I didn't find any information about this in the documentation.
