fix: stop marking JSON attributes as trusted HTML

2026-06-26 23:40:59 +02:00
parent b2f00e879a
commit 07eae2d971
3 changed files with 76 additions and 4 deletions
--- a/templates/funcs_test.go
+++ b/templates/funcs_test.go
@@ -47,7 +47,13 @@ func TestJSONAttr(t *testing.T) {
 	if err != nil {
 		t.Fatalf("jsonAttr error: %v", err)
 	}
-	want := template.HTMLAttr(`{"a":1}`)
+	if _, ok := any(got).(template.HTMLAttr); ok {
+		t.Fatal("jsonAttr returned trusted HTML attribute content")
+	}
+	if _, ok := any(got).(string); !ok {
+		t.Fatalf("jsonAttr returned %T, want string", got)
+	}
+	want := `{"a":1}`
 	if got != want {
 		t.Errorf("expected %q, got %q", want, got)
 	}