Repository navigation
Complete TextArea coverage with caller-owned escaping - #51
Merged
Merged
Conversation
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
joshbruce
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Complete the remaining TextArea coverage and documentation while preserving the existing library-wide contract: implementers own sanitization and escaping.
TextArea renders caller-supplied values unchanged, retaining the existing parser-consumed leading newline. It does not impose escaping flags, a character encoding, or invalid-character handling. Document caller responsibility, an illustrative application-side escaping call, the risk of unescaped closing textarea tags, and native CR/CRLF normalization. The implementation change is only a PHPDoc clarification; no runtime escaping change remains relative to main.
Add DOM-based tests for caller-escaped markup-like text, ampersands, quotes, entity syntax, different escaping flags, empty/populated values, whitespace/newlines, UTF-8, repeated rendering, and native rows/required/readonly/disabled attributes. Existing ControlGuidanceTest covers help preservation, string/object warnings, custom IDs, and single warning rendering.
The issue's safety criterion is interpreted under the caller-escaped usage contract, not as automatic sanitization of arbitrary raw input. This maintainer-directed clarification is recorded in #45 (comment).
Validation:
composer productionpassed on PHP 8.5.2 (source style, PHPStan, and 186 tests / 1,747 assertions, without warnings).git --no-pager diff --checkpassed.List of issues fixed
Fixes #45