Merge pull request #33 from studiometa/bugfix/attribute-escape

[Bugfix] Fix attribute escaping strategy

CHANGELOG.md

@@ -6,6 +6,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 
 ## [Unreleased]
 
+### Changed
+
+- Prefer the `html` escape mode to the `html_attr` ([#33](https://github.com/studiometa/twig-toolkit/pull/33), [c093446](https://github.com/studiometa/twig-toolkit/commit/c093446))
+
 ## v2.0.0 (2025-01-20)
 
 ### Changed

src/Helpers/Html.php

@@ -210,21 +210,13 @@ public static function renderAttributes(Environment $env, array $attributes):str
             }
 
             /** @var null|false|string */
-            $value = $env->getRuntime(EscaperRuntime::class)->escape($value, 'html_attr', $env->getCharset());
+            $value = $env->getRuntime(EscaperRuntime::class)->escape($value, 'html', $env->getCharset());
 
             // Do not add null & false attributes
             if (is_null($value) || $value === false) {
                 continue;
             }
 
-            // Escape value and replace some escaped characters to improve
-            // readability for the generated HTML.
-            $value = str_replace(
-                [' ', ':', '&#x3B;', '/'],
-                [' ', ':', ';', '/'],
-                $value
-            );
-
             $renderedAttributes[] = sprintf('%s="%s"', $key, $value);
         }
 

tests/__snapshots__/ElementTokenParserTest__The_____html__element_____Twig_tag_should_be_able_to_render_complex_attributes___1.txt

@@ -1,3 +1,3 @@
-<div aria-hidden="true" data-options="&#x7B;&quot;log&quot;:true&#x7D;">
+<div aria-hidden="true" data-options="{&quot;log&quot;:true}">
     Hello world
 </div>

tests/__snapshots__/HtmlTest__The_____html__attributes_______Twig_function_should_not_render_empty_attributes__1.txt

@@ -1 +1 @@
- empty-string="" truthy empty-array="[]"
+ empty-string="" truthy empty-array="[]"

tests/__snapshots__/HtmlTest__The_____html__attributes_______Twig_function_should_prevent_XSS_attacks__1.txt

@@ -1 +1 @@
- class="" onclick="alert(true)"
+ class="" onclick="alert(true)"