Quotes in interpolation in attribute string do not get parsed correctly about slang

[crisward]

I've added escaping and interpolation detection into the lexer in this pull request.
#16 I'm not sure if it's perfect, but it fixes the examples here.

[jeromegn]

Yes. I attempted that at some point but got frustrated with my macro chops not being good enough.

I'm sure this is a fairly simple change if somebody can wrap their head around it, else I can give it another shot soon enough!

Thanks for the report.

[jeromegn]

Any thoughts @kRaw1er ?

[jasonl99]

I just ran into this as well. Using @RX14 's example, here's another workaround:

- thread_id = thread["id"]; thread_subject = thread["subject"]
a href="/t/#{thread_id}" = thread_subject

[jeromegn]

@jasonl99 having to work around it is unfortunate.

I absolutely want to fix this, but the lexer is currently making my head spin. I wish some parsing libs were more mature (slim, for example, uses a popular ruby parser gem.)

IIRC, there are one or two for crystal (like: https://github.com/umurgdk/haydari) but they are outdated and usually WIP.

[crisward]

On the same note, I'd expect attr=blah for blah to be HTML.escaped and attr==blah to be unescaped. This doesn't appear to be the case, which could allow XSS attacks. This can be worked around by using HTML.escape around your attribute values, but this is easy to forget.

[jeromegn]

Should be fixed as of 1.4.2. Thanks @crisward!