Skip to content

Fix double escaping in delegate component - #192

Merged
ganyicz merged 3 commits into
mainfrom
filip/fix-double-escaping
Jul 27, 2026
Merged

Fix double escaping in delegate component#192
ganyicz merged 3 commits into
mainfrom
filip/fix-double-escaping

Conversation

@ganyicz

@ganyicz ganyicz commented Jul 27, 2026

Copy link
Copy Markdown
Collaborator

The scenario

Setting a bound property on a component that uses <flux:delegate-component> causes double escaping:

<flux:select :label="'Country & Region'">

renders the label as

Country &amp; Region

The problem

When compiling the delegate component we pass the current component data using $attributes:

<?php __3f7e096d528cdf($attributes->all(), ...) ?>

The problem is that Laravel (and Blaze respectively) escapes all bound attributes.

Because we're passing them through two component boundaries, they will become double escaped.

<flux:select :label="'Country & Region'">

<flux:delegate-component :label="'Country &amp; Region'">

Country &amp;amp; Region

The solution

Unescape the attributes before passing them into delegate component:

<?php __3f7e096d528cdf($__blaze->unescapeAttributes($attributes->all()), ...) ?>

Fixes #190

@github-actions

Copy link
Copy Markdown
Contributor

Benchmark Result: Default

Attempt Blade Blaze Improvement
#1 363.16ms 16.48ms 95.5%
#2 361.98ms 16.09ms 95.6%
#3 364.67ms 16.05ms 95.6%
#4 363.06ms 16.14ms 95.6%
#5 363.10ms 16.31ms 95.5%
#6 361.90ms 16.29ms 95.5%
#7 363.84ms 16.03ms 95.6%
#8 * 357.73ms 15.92ms 95.5%
#9 365.62ms 16.14ms 95.6%
#10 363.08ms 16.43ms 95.5%
Snapshot 366.20ms 16.10ms 95.6%
Result 363.10ms (~) 16.14ms (~) 95.6% (~)

Median of 10 attempts (* = outlier, excluded from result), 5000 iterations x 10 rounds, 47.74s total

To run a specific benchmark, comment /benchmark <name> where name is one of: attributes, aware, class, default, forwarding, merge, named-slots, no-attributes, slot

@ganyicz
ganyicz merged commit f0ad52c into main Jul 27, 2026
4 checks passed
@ganyicz
ganyicz deleted the filip/fix-double-escaping branch July 27, 2026 11:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Bound string props are double-escaped — & renders as literal &amp;

1 participant