{"action":"created","issue":{"url":"https://api.github.com/repos/ampproject/amphtml/issues/3460","repository_url":"https://api.github.com/repos/ampproject/amphtml","labels_url":"https://api.github.com/repos/ampproject/amphtml/issues/3460/labels{/name}","comments_url":"https://api.github.com/repos/ampproject/amphtml/issues/3460/comments","events_url":"https://api.github.com/repos/ampproject/amphtml/issues/3460/events","html_url":"https://github.com/ampproject/amphtml/issues/3460","id":158687349,"number":3460,"title":"[Validator] Template attribute values in `data-*` attributes not validated","user":{"login":"sidkshatriya","id":638477,"avatar_url":"https://avatars.githubusercontent.com/u/638477?v=3","gravatar_id":"","url":"https://api.github.com/users/sidkshatriya","html_url":"https://github.com/sidkshatriya","followers_url":"https://api.github.com/users/sidkshatriya/followers","following_url":"https://api.github.com/users/sidkshatriya/following{/other_user}","gists_url":"https://api.github.com/users/sidkshatriya/gists{/gist_id}","starred_url":"https://api.github.com/users/sidkshatriya/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sidkshatriya/subscriptions","organizations_url":"https://api.github.com/users/sidkshatriya/orgs","repos_url":"https://api.github.com/users/sidkshatriya/repos","events_url":"https://api.github.com/users/sidkshatriya/events{/privacy}","received_events_url":"https://api.github.com/users/sidkshatriya/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/ampproject/amphtml/labels/Related%20to:%20Validator","name":"Related to: Validator","color":"d4c5f9"},{"url":"https://api.github.com/repos/ampproject/amphtml/labels/Type:%20Bug","name":"Type: Bug","color":"f7c6c7"}],"state":"closed","locked":false,"assignee":{"login":"Gregable","id":25519,"avatar_url":"https://avatars.githubusercontent.com/u/25519?v=3","gravatar_id":"","url":"https://api.github.com/users/Gregable","html_url":"https://github.com/Gregable","followers_url":"https://api.github.com/users/Gregable/followers","following_url":"https://api.github.com/users/Gregable/following{/other_user}","gists_url":"https://api.github.com/users/Gregable/gists{/gist_id}","starred_url":"https://api.github.com/users/Gregable/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Gregable/subscriptions","organizations_url":"https://api.github.com/users/Gregable/orgs","repos_url":"https://api.github.com/users/Gregable/repos","events_url":"https://api.github.com/users/Gregable/events{/privacy}","received_events_url":"https://api.github.com/users/Gregable/received_events","type":"User","site_admin":false},"assignees":[{"login":"Gregable","id":25519,"avatar_url":"https://avatars.githubusercontent.com/u/25519?v=3","gravatar_id":"","url":"https://api.github.com/users/Gregable","html_url":"https://github.com/Gregable","followers_url":"https://api.github.com/users/Gregable/followers","following_url":"https://api.github.com/users/Gregable/following{/other_user}","gists_url":"https://api.github.com/users/Gregable/gists{/gist_id}","starred_url":"https://api.github.com/users/Gregable/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Gregable/subscriptions","organizations_url":"https://api.github.com/users/Gregable/orgs","repos_url":"https://api.github.com/users/Gregable/repos","events_url":"https://api.github.com/users/Gregable/events{/privacy}","received_events_url":"https://api.github.com/users/Gregable/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/ampproject/amphtml/milestones/4","html_url":"https://github.com/ampproject/amphtml/milestones/Backlog","labels_url":"https://api.github.com/repos/ampproject/amphtml/milestones/4/labels","id":1537240,"number":4,"title":"Backlog","description":"This milestone tracks issues that aren't currently prioritized for implementation.","creator":{"login":"rudygalfi","id":3888212,"avatar_url":"https://avatars.githubusercontent.com/u/3888212?v=3","gravatar_id":"","url":"https://api.github.com/users/rudygalfi","html_url":"https://github.com/rudygalfi","followers_url":"https://api.github.com/users/rudygalfi/followers","following_url":"https://api.github.com/users/rudygalfi/following{/other_user}","gists_url":"https://api.github.com/users/rudygalfi/gists{/gist_id}","starred_url":"https://api.github.com/users/rudygalfi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rudygalfi/subscriptions","organizations_url":"https://api.github.com/users/rudygalfi/orgs","repos_url":"https://api.github.com/users/rudygalfi/repos","events_url":"https://api.github.com/users/rudygalfi/events{/privacy}","received_events_url":"https://api.github.com/users/rudygalfi/received_events","type":"User","site_admin":false},"open_issues":249,"closed_issues":58,"state":"open","created_at":"2016-01-22T23:51:53Z","updated_at":"2016-07-01T21:54:43Z","due_on":null,"closed_at":null},"comments":4,"created_at":"2016-06-06T14:10:21Z","updated_at":"2016-07-01T21:54:43Z","closed_at":"2016-07-01T21:54:43Z","body":"The following template attribute values correctly generate validation errors:\r\n\r\n```html\r\n<template type=\"amp-mustache\">\r\n  <!-- validation error: UNESCAPED_TEMPLATE_IN_ATTR_VALUE -->\r\n  <div class=\"{{{ hello }}}\"></div>\r\n  <!-- validation error: TEMPLATE_PARTIAL_IN_ATTR_VALUE -->\r\n  <p class=\"{{ >testing }}}\"></p>\r\n</template>\r\n```\r\n\r\nThese errors are triggered by the `validateAttrValueBelowTemplateTag()`\r\n\r\nInterestingly, the following _will not_ trigger any validation error:\r\n```html\r\n<template type=\"amp-mustache\">\r\n  <!-- no validation error -->\r\n  <div data-message=\"{{{ hello }}}\"></div>\r\n  <!-- no validation error -->\r\n  <p data-message=\"{{ >testing }}}\"></p>\r\n</template>\r\n```\r\n\r\nThis is because all `data-*` attribute values are not validated at all. (`data-*` attribute _names_ are validated though). (see `validateAttrNotFoundInSpec()`)\r\n\r\nIs this behaviour correct? Should we not check `data-*` values also whether they have a correct value if they are underneath template tags?\r\n\r\nThis seems to contradict the comment \"We disallow these in attribute values\" (see below)\r\n\r\n```javascript\r\nstatic valueHasUnescapedTemplateSyntax(value) {\r\n    // Mustache (https://mustache.github.io/mustache.5.html), our template\r\n    // system, supports {{{unescaped}}} or {{{&unescaped}}} and there can\r\n    // be whitespace after the 2nd '{'. We disallow these in attribute Values.\r\n    const unescapedOpenTag = new RegExp('{{\\\\s*[&{]');\r\n    return unescapedOpenTag.test(value);\r\n  }\r\n```\r\n\r\nAnother contradiction: \"We disallow partials in attribute values\" as partials are allowed in `data-*` (see below)\r\n\r\n```javascript \r\nstatic valueHasPartialsTemplateSyntax(value) {\r\n    // Mustache (https://mustache.github.io/mustache.5.html), our template\r\n    // system, supports 'partials' which include other Mustache templates\r\n    // in the format of {{>partial}} and there can be whitespace after the {{.\r\n    // We disallow partials in attribute values.\r\n    const partialsTag = new RegExp('{{\\\\s*>');\r\n    return partialsTag.test(value);\r\n  }\r\n"},"comment":{"url":"https://api.github.com/repos/ampproject/amphtml/issues/comments/230055854","html_url":"https://github.com/ampproject/amphtml/issues/3460#issuecomment-230055854","issue_url":"https://api.github.com/repos/ampproject/amphtml/issues/3460","id":230055854,"user":{"login":"Gregable","id":25519,"avatar_url":"https://avatars.githubusercontent.com/u/25519?v=3","gravatar_id":"","url":"https://api.github.com/users/Gregable","html_url":"https://github.com/Gregable","followers_url":"https://api.github.com/users/Gregable/followers","following_url":"https://api.github.com/users/Gregable/following{/other_user}","gists_url":"https://api.github.com/users/Gregable/gists{/gist_id}","starred_url":"https://api.github.com/users/Gregable/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Gregable/subscriptions","organizations_url":"https://api.github.com/users/Gregable/orgs","repos_url":"https://api.github.com/users/Gregable/repos","events_url":"https://api.github.com/users/Gregable/events{/privacy}","received_events_url":"https://api.github.com/users/Gregable/received_events","type":"User","site_admin":false},"created_at":"2016-07-01T21:54:43Z","updated_at":"2016-07-01T21:54:43Z","body":"Resolved. This will be deployed to cdn.ampproject.org next week."}}
{"actor":{"display_login":"Gregable"}}