diff --git a/content/en/functions/safeCSS.md b/content/en/functions/safeCSS.md index 7861932c9..197c7c25e 100644 --- a/content/en/functions/safeCSS.md +++ b/content/en/functions/safeCSS.md @@ -12,6 +12,7 @@ relatedFuncs: - safe.HTML - safe.HTMLAttr - safe.JS + - safe.JSStr - safe.URL signature: - safe.CSS INPUT diff --git a/content/en/functions/safeHTML.md b/content/en/functions/safeHTML.md index 025471899..9d981411e 100644 --- a/content/en/functions/safeHTML.md +++ b/content/en/functions/safeHTML.md @@ -12,6 +12,7 @@ relatedFuncs: - safe.HTML - safe.HTMLAttr - safe.JS + - safe.JSStr - safe.URL signature: - safe.HTML INPUT diff --git a/content/en/functions/safeHTMLAttr.md b/content/en/functions/safeHTMLAttr.md index b2e5f4649..7efd7b651 100644 --- a/content/en/functions/safeHTMLAttr.md +++ b/content/en/functions/safeHTMLAttr.md @@ -12,6 +12,7 @@ relatedFuncs: - safe.HTML - safe.HTMLAttr - safe.JS + - safe.JSStr - safe.URL signature: - safe.HTMLAttr INPUT diff --git a/content/en/functions/safeJS.md b/content/en/functions/safeJS.md index 8e32b0bd0..ae47cb56a 100644 --- a/content/en/functions/safeJS.md +++ b/content/en/functions/safeJS.md @@ -12,6 +12,7 @@ relatedFuncs: - safe.HTML - safe.HTMLAttr - safe.JS + - safe.JSStr - safe.URL signature: - safe.JS INPUT diff --git a/content/en/functions/safeJSStr.md b/content/en/functions/safeJSStr.md new file mode 100644 index 000000000..1b62b1d5f --- /dev/null +++ b/content/en/functions/safeJSStr.md @@ -0,0 +1,59 @@ +--- +title: safeJSStr +description: Declares the provided string as a known safe JavaScript string. +categories: [functions] +menu: + docs: + parent: functions +keywords: [] +namespace: safe +relatedFuncs: + - safe.CSS + - safe.HTML + - safe.HTMLAttr + - safe.JS + - safe.JSStr + - safe.URL +signature: + - safe.JSStr INPUT + - safeJSStr INPUT +--- + +Encapsulates a sequence of characters meant to be embedded between quotes in a JavaScript expression. Use of this type presents a security risk: the encapsulated content should come from a trusted source, as it will be included verbatim in the template output. + +Without declaring a variable to be a safe JavaScript string: + +```go-html-template +{{ $title := "Lilo & Stitch" }} + +``` + +Rendered: + + +```html + +``` + +To avoid escaping by Go's [html/template] package: + +```go-html-template +{{ $title := "Lilo & Stitch" }} + +``` + +Rendered: + +```html + +``` + +[html/template]: https://pkg.go.dev/html/template diff --git a/content/en/functions/safeURL.md b/content/en/functions/safeURL.md index e205e9748..417bb7a7b 100644 --- a/content/en/functions/safeURL.md +++ b/content/en/functions/safeURL.md @@ -13,6 +13,7 @@ relatedFuncs: - safe.HTML - safe.HTMLAttr - safe.JS + - safe.JSStr - safe.URL signature: - safe.URL INPUT