nette / latte

95%

master: 95%

LAST BUILD ON BRANCH srcdoc-escaping

branch: srcdoc-escaping

CHANGE BRANCH

x

Reset

• srcdoc-escaping
• 3.1.4
• attribute-contexts
• check-url-null
• dedent-preserve-structural-indentation
• master
• next
• v2.10
• v2.10.10
• v2.11
• v2.11.7
• v2.5
• v2.6
• v2.7
• v2.8
• v2.9
• v3.0
• v3.0.10
• v3.0.11
• v3.0.11-RC1
• v3.0.12
• v3.0.13
• v3.0.14
• v3.0.15
• v3.0.16
• v3.0.17
• v3.0.18
• v3.0.19
• v3.0.20
• v3.0.21
• v3.0.22
• v3.0.23
• v3.0.24
• v3.0.25
• v3.0.9
• v3.1.0
• v3.1.1
• v3.1.2
• v3.1.3
• v3.1.4
• v3.1.5
• v3.1.6
• wip

Build # 36471705746

Build Type

push

github

Committed by vrana

Commit Message

HtmlHelpers: srcdoc triggers a migration warning for a value previously rendered as HTML

With Feature::MigrationWarnings, a plain srcdoc value that renders as a different
document now than before (it contains '<' or a character reference) triggers
a warning suggesting to wrap trusted HTML in Latte\Runtime\Html. Text such as
'a & b' renders the same document as before and stays quiet; so does an Html
object, whose tags were stripped before and are kept now. |accept silences it.

It covers dynamic attributes (srcdoc={$x}, srcdoc="{$x}") and n:attr. A mixed
value like srcdoc="<p>{$x}</p>" is escaped by code the Escaper emits, which has
no access to feature flags, so it does not warn.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Coverage Stats

8 of 8 new or added lines in 1 file covered. (100.0%)

6088 of 6412 relevant lines covered (94.95%)

0.95 hits per line