Skip to content

Commit

Permalink
Switch govuk link button to an inclusion tag
Browse files Browse the repository at this point in the history
This is to ensure that any potential HTML tags are sanitised correctly through using Django's template engine
  • Loading branch information
kevincarrogan committed Dec 19, 2024
1 parent c1be8f9 commit 3506ad5
Show file tree
Hide file tree
Showing 2 changed files with 24 additions and 19 deletions.
8 changes: 8 additions & 0 deletions lite_forms/templates/govuk-link-button.html
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
<a {% if id %}id="button-{{ id }}" {% endif %}href="{{ url }}{{ query_params }}" role="button" draggable="false" class="govuk-button {{ classes }}" data-module="govuk-button"{% if hidden %} style="display: none;"{% endif %}>
{% lcs text %}
{% if show_chevron %}
<svg class="govuk-button__start-icon" xmlns="http://www.w3.org/2000/svg" width="13" height="15" viewBox="0 0 33 43" aria-hidden="true" focusable="false">
<path fill="currentColor" d="M0 0h13l20 20-20 20H0l20-20z" />
</svg>
{% endif %}
</a>
35 changes: 16 additions & 19 deletions lite_forms/templatetags/custom_tags.py
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,6 @@
from django.urls import reverse
from django.utils.safestring import mark_safe

from core.builtins.custom_tags import get_const_string
from lite_forms.helpers import flatten_data


Expand Down Expand Up @@ -199,27 +198,25 @@ def item_with_rating_exists(items, rating):
return True


@register.simple_tag
@mark_safe # noqa: S308
@register.inclusion_tag("govuk-link-button.html")
def govuk_link_button(text, url, url_param=None, id="", classes="", query_params="", show_chevron=False, hidden=False):
text = get_const_string(text)
if not url_param:
url_param = []

if isinstance(url_param, str):
url_param = [url_param]
url = reverse(url, args=url_param if url_param else [])
id = f'id="button-{id}"' if id else ""
chevron = ""
if show_chevron:
chevron = (
'<svg class="govuk-button__start-icon" xmlns="http://www.w3.org/2000/svg" width="13" height="15" '
'viewBox="0 0 33 43" aria-hidden="true" focusable="false">'
'<path fill="currentColor" d="M0 0h13l20 20-20 20H0l20-20z" /></svg>'
)
hidden = 'style="display: none;"' if hidden else ""

return (
f'<a {id} href="{url}{query_params}" role="button" draggable="false" class="govuk-button {classes}" {hidden} '
f'data-module="govuk-button">{text}{chevron}</a>'
)

url = reverse(url, args=url_param)

return {
"text": text,
"url": url,
"id": id,
"classes": classes,
"show_chevron": show_chevron,
"hidden": hidden,
"query_params": query_params,
}


@register.filter()
Expand Down

0 comments on commit 3506ad5

Please sign in to comment.