proposal: x/net/html: add RawNode

[MagicalTux]

html raw nodes

Sometimes there is a need after parsing HTML to insert more html contents without having to parse the added contents (for example, server side rendering of HTML code).

It should be fairly simple to add the following to x/net/html:

• New NodeType called RawNode.
• In Render, add a case RawNode that just calls WriteString, without any escaping.

        case RawNode:
                _, err := w.WriteString(n.Data)
                return err

(I looked at submitting a pull request, but it's just too much hassle going through gerrit for 4 lines of code)

current situation

Right now the easiest way to add raw html is through a CommentNode by including tags to end and resume comment, but this is not optimal. Adding a RawNode NodeType wouldn't have any negative impact and would allow adding raw html prior to rendering of contents for cases when HTML is obtained as is and doesn't need to be parsed.

[smasher164]

/cc @nigeltao @namusyaka

[nigeltao]

I'm not keen on using golang.org/x/net/html for server-side rendering. Use the standard library's html/template instead. Yes, the former has nodes and the latter is text based, but the latter is explicitly designed to render HTML securely.

[MagicalTux]

We have reasons why html/template is not appropriate because it is made to render HTML securely, why we need to render HTML that has already been made secure by the underlying libraries (ie. react-dom, etc). Also, ideally we'd like to keep source files as generated automatically and not have to build specific versions for html/template, hence making golang.org/x/net/html a better bet.

Right now the way we render things is (for example):

        div.AppendChild(&html.Node{
                Type: html.CommentNode,
                Data: " begin app -->" + app + "<!-- end app ",
        })

This works fine, but I feel implementing a html.RawNode would cost virtually nothing and help for cases when people using golang.org/x/net/html want to insert pre-generated HTML, in a similar way to how json has json.RawMessage.

[gopherbot]

Change https://golang.org/cl/216800 mentions this issue: html: add the RawNode NodeType

[nigeltao]

I was concerned about security implications, but you're right that we can already render arbitrary (insecure) HTML with a CommentNode.

Let's do this: https://golang.org/cl/216800