racket / web-server

Other
90 stars 47 forks source link

`response/xexpr` should respect `current-unescaped-tags` #122

Open massung opened 2 years ago

massung commented 2 years ago

Because https://github.com/racket/web-server/blob/8d9c0f72bf4dd43784f50e810d8359d29485f6fd/web-server-lib/web-server/http/xexpr.rkt#L30 is a function, when it is called any parameterized change to current-unescaped-tags is completely ignored or must be set at a much more global level, which is undesirable.

Example:

(define (start req)
  (parameterize ([current-unescaped-tags html-unescaped-tags])
    (response/xexpr
     `(html (head (script "let x = 1 < 2;"))))))

When run, the above will fail because it will convert the < to &lt; when that isn't the intention. I'd recommend changing the output function to first capture - and then reuse - the value:

(let ([unescaped-tags (current-unescaped-tags)])
  (λ (out)
    (parameterize ([current-unescaped-tags unescaped-tags])
      (write-bytes preamble out)
      (write-xexpr xexpr out))))

But there may be something a bit lower level that could work as well.