wip

brendt · brendt · commit db8eb8d1111b · 2025-11-05T09:01:59.000+01:00
diff --git a/composer.json b/composer.json
@@ -25,15 +25,15 @@
         "nette/php-generator": "^4.1.6",
         "nikic/php-parser": "^5.3",
         "php": "^8.4",
-        "psr-discovery/http-client-implementations": "^1.4",
-        "psr-discovery/http-factory-implementations": "^1.2",
+        "psr-discovery/http-client-implementations": "^1.2",
+        "psr-discovery/http-factory-implementations": "^1.4",
         "psr/cache": "^3.0",
         "psr/clock": "^1.0.0",
         "psr/http-client": "^1.0.0",
         "psr/http-factory": "^1.0",
         "psr/http-message": "^1.0|^2.0",
         "psr/log": "^3.0.0",
-        "rector/rector": "^2.1",
+        "rector/rector": "2.2.1",
         "symfony/cache": "^7.3",
         "symfony/mailer": "^7.2.6",
         "symfony/process": "^7.3",
diff --git a/packages/view/src/Exceptions/AttributesWithSingleQuotesWereNotAllowed.php b/packages/view/src/Exceptions/AttributesWithSingleQuotesWereNotAllowed.php
@@ -0,0 +1,9 @@
+<?php
+
+namespace Tempest\View\Exceptions;
+
+use Exception;
+
+final class AttributesWithSingleQuotesWereNotAllowed extends Exception
+{
+}
diff --git a/packages/view/src/Parser/TempestViewLexer.php b/packages/view/src/Parser/TempestViewLexer.php
@@ -2,6 +2,8 @@
 
 namespace Tempest\View\Parser;
 
+use Tempest\View\Exceptions\AttributesWithSingleQuotesWereNotAllowed;
+
 final class TempestViewLexer
 {
     private const string WHITESPACE = PHP_EOL . "\n\t\f ";
@@ -131,6 +133,10 @@ private function lexTag(): array
                 );
 
                 if ($hasValue) {
+                    if ($this->seek() === '\'') {
+                        throw new AttributesWithSingleQuotesWereNotAllowed();
+                    }
+
                     $attributeValue = $this->consumeIncluding('"');
                     $attributeValue .= $this->consumeIncluding('"');
 
diff --git a/packages/view/tests/TempestViewLexerTest.php b/packages/view/tests/TempestViewLexerTest.php
@@ -4,6 +4,7 @@
 
 use PHPUnit\Framework\Attributes\TestWith;
 use PHPUnit\Framework\TestCase;
+use Tempest\View\Exceptions\AttributesWithSingleQuotesWereNotAllowed;
 use Tempest\View\Parser\TempestViewLexer;
 use Tempest\View\Parser\Token;
 use Tempest\View\Parser\TokenCollection;
@@ -346,6 +347,17 @@ public function test_xml(): void
         );
     }
 
+    public function test_single_quote_attributes(): void
+    {
+        $html = <<<HTML
+        <div class='hello'></div>
+        HTML;
+
+        $this->expectException(AttributesWithSingleQuotesWereNotAllowed::class);
+
+        new TempestViewLexer($html)->lex();
+    }
+
     private function assertTokens(array $expected, TokenCollection $actual): void
     {
         $this->assertCount(count($expected), $actual);
diff --git a/tests/Integration/View/TempestViewRendererTest.php b/tests/Integration/View/TempestViewRendererTest.php
@@ -5,6 +5,7 @@
 namespace Tests\Tempest\Integration\View;
 
 use Tempest\Support\Html\HtmlString;
+use Tempest\View\Exceptions\AttributesWithSingleQuotesWereNotAllowed;
 use Tempest\View\Exceptions\ElementWasInvalid;
 use Tempest\View\ViewCache;
 use Tests\Tempest\Fixtures\Controllers\RelativeViewController;
@@ -847,4 +848,13 @@ public function test_parse_rss_feed(): void
         </feed>
         RSS, $parsed);
     }
+
+    public function test_attributes_with_single_quotes(): void
+    {
+        $this->expectException(AttributesWithSingleQuotesWereNotAllowed::class);
+
+        $html = $this->render(<<<'HTML'
+        <div class='hello'></div>
+        HTML);
+    }
 }
