Expand description
Phase B, the forms half: the escaper, the field classes and the rules a described field’s markup is drawn with.
The field markup itself is drawn by the quasi hosts (quasi-webview for
this renderer), which own the vocabulary member. What stays here is what
every caller writing HTML needs and what the generated stylesheet has to
agree with: escape and escape_into, Markup and Filling, the
class lists, and the rules behind them.
§Why one escaper is enough
goingson carries four escapers and 543 call sites that must pick between
them, because escapeHtml is built on textContent serialization and
textContent refuses to encode ". That is what makes it unsound in an
attribute, and it is the whole reason the choice exists. Its escape.js
records the finding as the CHRONIC-XSS seal, and its test suite has a gate
keeping the unsafe one off the namespace.
escape here is not built on that, so it encodes the quote along with
everything else, which makes one function sound in both sinks. The four-way
choice does not move into Rust: it disappears. A caller hands an unescaped
value to the output only through Markup, which it has to name.
§What the description does not carry
One thing: the current value, which arrives in Filling. A webview
reads it back out of the DOM, an immediate-mode renderer writes through a
&mut, and a terminal keeps an edit buffer; a description carrying it would
have to carry a way to write it back, at which point it is a form model.
Structs§
- Filling
- Everything about the field that the description does not carry.
- Markup
- A string that is already markup, and is emitted without escaping.
Constants§
- FIELD_
CLASSES - Every class a field’s markup can carry.
- FIELD_
STATE_ CLASSES - The state classes a field carries, which take no prefix.
Functions§
- escape
- Encode the five characters that let a value stop being a value.
- escape_
into - Encode the five characters that let a value stop being a value, into a buffer the caller already has.