-
Notifications
You must be signed in to change notification settings - Fork 48
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Issue #168: implement content escaping (take 2) #217
Conversation
test(function() { | ||
}, [ { html: [ '<danger>' ] }, | ||
{ html: { toString: function () { return '<lol>'; } } } ], | ||
'<div></div><div></div>'); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Хотя, если не обрабатывается toString, то там можно вывести блоки без экранирования? Так, чтоли?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@zxqfox nope.
{
html: { block: 'test', content: 'H&M' }
}
Will treated as:
{}
<div></div>
because of typeof html !== 'string'
therefore html
— will treated as user defined field.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Black magic.
👎
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
если мы не хотим разрешать в html
ничего кроме строк, то нужно явно кидать ексепшен в этом месте, а не делать так, чтобы объекты с toString
рендерились не в строку
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
я так и не понял, что мы делаем для кейсов, когда там не строка, а объект? точно мы не хотим бросать эксепшен??
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
У нас люди не очень любят эксепшны. Мы можем подумать в сторону варнингов, чтобы писать про такое в логи, например.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Дело не в том, что любят люди :)
Просто я бы не стал никак делать лишних ограничений. Есть поведение задекларированное и мы будем его поддерживать (передавай строку), а всё остальное не гарантируется, используй на свой страх и риск.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Вообще, я за как можно меньше доп логики в шаблонизаторе — нет смысла в лишних проверках, жрущих CPU и требующих документации. Проверка на какие-то поля block/elem/tag/content (?) кажется вполне разумным компромисом, учитывая что мы не можем проверить просто html, потому что это кому-то что-то может сломать (мажор может просто?).
Big question about benchmarks! Now they are go to dissemble («a little bit») because in BEMJSON there is not so many text nodes. basic.bemjson more over is too small even for any other benchmarks. I suggest to add one more example similar to SERP in terms of total amount of different blocks (for other benchmarks) and in terms of proportions between BEM-entities and their text content (for this particular case of benchmarking). |
@@ -104,6 +104,23 @@ | |||
} | |||
``` | |||
|
|||
Объект с полем `html` является специальным значением поля `content`. Все другие |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
скорее «является специальным типом возможных объектов в BEMJSON» — как минимум, потому, что я могу написать
{
block: 'b1',
content: [
'1',
{ html: '2' },
'3'
]
}
и это уже не будет всем значением поля content
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
html
является специальным полем объекта в BEMJSON
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@mishanga Это в bh ;-)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
скорее «является специальным типом возможных объектов в BEMJSON»
Fixed.
Rebased from master. |
c2102ab
to
d10b854
Compare
To all: so, let’s merge it today? |
can't catch what exactly numbers for bench results? |
@veged depends on project. But average diff +1% on |
please, put this in clearly description ;-) and merge |
Description updated. |
Instead of #178
escapeContent
flag{ html: '…' }
Benchmarks
results for 10000 runs:
average diff 1% (from 1μs) slower on
apply()
and the same oncompile()
Islands & shocase bemhtml outdated.
The plan:
escapeContent:false
option.escapeContent:true
option.