Escape hatch to bypass Phlex HTML safety

[joeldrapper]

@bradgessler recently brought up the need for this again, and suggested having a safe method that we can use to wrap any safe value.

div(onclick: safe("foo")) { "Foo" }
a(href: safe("javascript:bar")) { "Bar" }

I think this would work quite nicely. safe could return a Phlex::SafeValue, e.g.

def safe(value)
  Phlex::SafeValue.new(value)
end

And we can check for that when building attributes.

if Phlex::SafeValue === value
  ...
end

[bradgessler]

Draft PR at https://github.com/phlex-ruby/phlex/pull/719

[joelmoss]

What's the difference between unsafe_raw and this?

[joeldrapper]

You can't use unsafe raw around an attribute, you would need to write the whole element by hand.