phlexing icon indicating copy to clipboard operation
phlexing copied to clipboard

More than one ERB string interpolation in HTML attribute

Open marcoroth opened this issue 3 years ago • 1 comments

ERB Input:

<div style="<%= "background: red;" %><%= "display: block;" %>"></div>

Output:

div(style: ("background: red;" %><%=), block: %(), erb: %(), display:: %()) { %(">)
 }

Expected output:

div(style: %(#{"background: red;"}#{"display: block"}))

marcoroth avatar Feb 06 '23 16:02 marcoroth

The Deface parser is currently not correctly transforming this provided input:

require "deface"

html = %(<div style="<%= "background: red;" %> <%= "display: block;" %>"></div>)

Deface::Parser.erb_markup!(html)

html
# => "<div  data-erb-style=\"&lt;%= &quot;background: red;&quot; %&gt; &lt;%= \"display: block;\" </erb>\"></div>"

The second set of quotes within an HTML attribute doesn't get escaped.

marcoroth avatar Feb 06 '23 16:02 marcoroth