Expand description
Phase B, the forms half: makeover_layout::Field rendered to HTML.
§Why this emits strings
Both webview apps build their markup as strings and hand it to innerHTML:
goingson’s renderFormField returns a template literal that fifteen call
sites interpolate into larger literals, and Balanced Breakfast’s builds
nodes but appends them into the same string-built forms. Returning nodes
would rewrite the surrounding templates as well, which makes it a migration
rather than an adoption. So: strings, and the escaping comes with them.
§Why one escaper is enough here
goingson carries four escapers and 543 call sites that must pick between
them, because escapeHtml is built on textContent serialization and
textContent refuses to encode ". That is what makes it unsound in an
attribute, and it is the whole reason the choice exists. Its escape.js
records the finding as the CHRONIC-XSS seal, and its test suite has a gate
keeping the unsafe one off the namespace.
escape here is not built on that, so it encodes the quote along with
everything else, which makes one function sound in both sinks. The four-way
choice does not move into Rust: it disappears. Nothing in this module hands
an unescaped value to the output except through Markup, which a caller
has to name.
§What the description does not carry
Field describes the field and not its contents, so three things arrive
from the renderer side in Filling: the current value, the options of a
select, and the placeholder. The first two are genuinely renderer state. The
third is user-facing text and belongs with label and hint in
makeover-layout; it lives here because that crate is published and adding a
field to Field is a breaking change, not because this is its home.
Structs§
- Choice
- One option of a select.
- Filling
- Everything about the field that the description does not carry.
- Markup
- A string that is already markup, and is emitted without escaping.
Enums§
- Value
- What the field currently holds.
Functions§
- escape
- Encode the five characters that let a value stop being a value.
- field_
html - One field, as the group the app drops into its form.