[wiki] wikiprocessor fails to properly render tag attributes with dashes hyphens eg. "data-collapse"

[lkraav <leho@…>]

How to reproduce:

• [wiki] render_unsafe_content = true
• edit whatever, type {{{#!div data-collapse=""
• observe dom changes in inspector

Result:

<div collapse="">

Expected:

<div data-collapse="">

Is this a Genshi bug or some Trac downstream configuration?

PS how do I add to safe_attrs list, so I could enable data-collapse or whatever without enabling full blown render_unsafe_content?

[lkraav <leho@…>]

​https://developer.mozilla.org/en-US/docs/Web/Guide/HTML/Using_data_attributes this data-* is a standardized attribute class, so should be handled accordingly for sure

[lkraav <leho@…>]

Not 100% if I'm seeing this correctly but

{{{#!div data_collapse=""
}}}

so underscore seems to get converted to hyphen data-collapse. I'm confused but I'll take it for time being.

[Jun Omae]

Currently, processor's parameter name disallows hyphen characters.

>>> from trac.wiki.parser import parse_processor_args
>>> parse_processor_args('data-name="1"')
{'name': '1'}   # ==> should be {'data-name': '1'} or {}

Also, the parser for processor's parameters has a defect.

trac/wiki/parser.py

@@ -62 +62 @@
     XML_NAME = r"[\w:](?<!\d)[\w:.-]*?" # See http://www.w3.org/TR/REC-xml/#id
 
     PROCESSOR = r"(\s*)#\!([\w+-][\w+-/]*)"
-    PROCESSOR_PARAM = r'''(?P<proc_pname>\w+)=(?P<proc_pval>".*?"|'.*?'|\w+)'''
+    PROCESSOR_PARAM = r'''(?P<proc_pname>[-\w]+)''' \
+                      r'''=(?P<proc_pval>".*?"|'.*?'|[-\w]+)'''
 
     def _set_anchor(name, sep):
         return r'=#(?P<anchorname>%s)(?:%s(?P<anchorlabel>[^\]]*))?' % \
@@ -225 +226 @@
         return wikitext
 
 
+_processor_pname_re = re.compile(r'[-\w]+$')
+
+
 def parse_processor_args(processor_args):
     """Parse a string containing parameter assignments,
     and return the corresponding dictionary.
@@ -244 +248 @@
               for v in args[2::3]]
     for flags in args[::3]:
         for flag in flags.strip().split():
-            if re.match(r'-?\w+$', flag):
+            if _processor_pname_re.match(flag):
                 if flag[0] == '-':
                     if len(flag) > 1:
                         keys.append(str(flag[1:]))

We could add unit tests for parse_processor_args(). I'll post revised patch with unit tests.

[Jun Omae]

Proposed changes in [9159ea2d6/jomae.git].

[Ryan J Ollos]

Replying to lkraav <leho@…>:

PS how do I add to safe_attrs list, so I could enable data-collapse or whatever without enabling full blown render_unsafe_content?

I guess it is not (yet) possible: tags/trac-1.1.4/trac/util/html.py@:76#L74​. Another question though is whether Genshi should just treat the data- attributes as safe, or perhaps we can do that from Trac when we move from XHMTL to HTML5. That might avoid the need for a [wiki] safe_attrs option.

Related use cases I've considered:

• allowing unsafe content only for read-only pages, thus only WIKI_ADMIN could edit the pages when ReadonlyWikiPolicy is enabled.
• restricting unsafe content to a specified set of pages.

Proposed change looks good to me.

[Jun Omae]

Thanks for the reviewing. Committed in [14052] and merged to trunk in [14053].