FlowDrop Workflow Specification 1.0-draft

Encoded exactly once, and quoted where a quote would end an attribute

The counterpart to encoding the whole input up front: nothing downstream may encode a second time, and the few places a value is interpolated into an attribute need the quote characters that the text path deliberately leaves alone.

The rule

Normative: this is the rule
  1. Text is encoded exactly once.
  2. A sequence the conversion itself wrote must not be encoded again: a < in the markdown source appears in the output as &lt; and never as &amp;lt;.
  3. A text node may keep literal quote characters, which are harmless there.
  4. A value interpolated into an attribute (a link target, an image source, an image alternative text) must have its quote characters escaped, so the value cannot end its own attribute and open an event handler.
  5. A URL carrying a dangerous scheme must be stripped rather than emitted.
Rule identifiers are permanent and are never renumbered. Each implementation publishes its own standing against these rules; this specification does not.spec 1.0-draft · MD-2 · changed in spec 1.0