Expand description
Phase B, the forms half: makeover_layout::Field rendered to HTML.
§Why this emits strings
Both webview apps build their markup as strings and hand it to innerHTML:
goingson’s renderFormField returns a template literal that fifteen call
sites interpolate into larger literals, and Balanced Breakfast’s builds
nodes but appends them into the same string-built forms. Returning nodes
would rewrite the surrounding templates as well, which makes it a migration
rather than an adoption. So: strings, and the escaping comes with them.
§Why one escaper is enough here
goingson carries four escapers and 543 call sites that must pick between
them, because escapeHtml is built on textContent serialization and
textContent refuses to encode ". That is what makes it unsound in an
attribute, and it is the whole reason the choice exists. Its escape.js
records the finding as the CHRONIC-XSS seal, and its test suite has a gate
keeping the unsafe one off the namespace.
escape here is not built on that, so it encodes the quote along with
everything else, which makes one function sound in both sinks. The four-way
choice does not move into Rust: it disappears. Nothing in this module hands
an unescaped value to the output except through Markup, which a caller
has to name.
§What the description does not carry
One thing: the current value, which arrives in Filling.
It used to be three. Writing this emitter is what found them, and the other
two turned out not to be renderer state at all — the placeholder is
user-facing text that sits with label and hint, and a select’s options
are needed by every renderer, which is how each of them ends up inventing a
near-miss of the same struct. Both moved down into makeover-layout 0.8.0,
Choice included, and this crate reads them off Field now.
The value stays, and it is not a leftover. A webview reads it back out of
the DOM, an immediate-mode renderer writes through a &mut, and a terminal
keeps an edit buffer; a description carrying it would have to carry a way to
write it back, at which point it is a form model.
Structs§
- Filling
- Everything about the field that the description does not carry.
- Markup
- A string that is already markup, and is emitted without escaping.
Enums§
- Value
- What the field currently holds.
Functions§
- escape
- Encode the five characters that let a value stop being a value.
- field_
html - One field, as the group the app drops into its form.