gohugoio / hugo

The world’s fastest framework for building websites.
https://gohugo.io
Apache License 2.0
75.38k stars 7.49k forks source link

.RenderShortcodes generates artifact when used nested in HTML #12854

Open McShelby opened 1 month ago

McShelby commented 1 month ago

Configured renderer.unsafe=true and then using .RenderShortcodes in a shortcode used with % generates artifacts in the form of {{__hugo_ctx pid=3}}.

Is this intended?

This can be seen in the sample repo in http:/localhost:1313/posts

https://github.com/McShelby/hugo-testing/tree/hugo-issue-12854

What version of Hugo are you using (hugo version)?

$ hugo version
hugo v0.134.2-1c74abd26070b0c12849550c974a9f3f1e7afb06 windows/amd64 BuildDate=2024-09-10T10:46:33Z VendorInfo=gohugoio

Does this issue reproduce with the latest release?

Yes. The used version was the latest.

bep commented 1 month ago

Is this intended?

No, but I'm assuming you're doing something ... unusual that we didn't think of when we implemented this. Because it doesn't always happen.

McShelby commented 1 month ago

Hm. I stripped the sample down to the bones. In my view, nothing special here.

bep commented 1 month ago

This usage is unusual:

{{- range .Page.Pages }}
<h3>{{ .Title | safeHTML }}</h3>
<div>{{ .RenderShortcodes | safeHTML }}</div>
{{- end }}

I suggest you read the documentation and/or start a thread in the forum about the intention/use cases of .RenderShortcodes. It's a method with very limited but useful use: Including markdown in markdown, so to speak.

McShelby commented 1 month ago

For others who may come around: The artifacts seem to be avoided if the shortcode is changed by adding a blank line in front of .RenderShortcodes.

{{- range .Page.Pages }}
<h3>{{ .Title | safeHTML }}</h3>
<div>

{{ .RenderShortcodes | safeHTML }}
</div>
{{- end }}
bep commented 1 month ago

For others who may come around:

Please read and understand the documentation at https://gohugo.io/methods/page/rendershortcodes/ and consider if you really need to use this method. It is very useful, but it a special purpose method.

If you wrap your .RenderShortcodes in a div and pipe it to safeHTML, the answer is no.