Support unescaped html (#181)

* Introduce htmlstring to support unescaped html

* Make the comments more explicit

Author: mattesmohr

…TMLKit/Framework/Rendering/Encoder.swift …amework/Rendering/Encoding/Encoder.swiftSources/HTMLKit/Framework/Rendering/Encoder.swift renamed to Sources/HTMLKit/Framework/Rendering/Encoding/Encoder.swift Sources/HTMLKit/Framework/Rendering/Encoder.swift renamed to Sources/HTMLKit/Framework/Rendering/Encoding/Encoder.swift

@@ -0,0 +1,15 @@
+/// A type that remains unescaped during rendering.
+///
+/// > Warning: Use with caution, as this may lead to security vulnerabilities
+/// > if the argument is not properly validated or not trusted.
+@_documentation(visibility: internal)
+public struct HtmlString: Content {
+    
+    /// The wrapped string
+    internal let value: String
+    
+    /// Initializes an html string
+    public init(_ value: String) {
+        self.value = value
+    }
+}

Sources/HTMLKit/Framework/Rendering/Encoding/HtmlString.swift

@@ -155,6 +155,9 @@ public struct Renderer {
             case let string as EnvironmentString:
                 try render(envstring: string, on: &result)
 
+            case let string as HtmlString:
+                result += string.value
+                
             case let doubleValue as Double:
                 result += String(doubleValue)
 
@@ -501,6 +504,9 @@ public struct Renderer {
             case let string as EnvironmentString:
                 try render(envstring: string, on: &result)
 
+            case let string as HtmlString:
+                result += string.value
+                
             case let string as String:
                 result += escape(content: string)
 

Sources/HTMLKit/Framework/Rendering/Renderer.swift

@@ -111,5 +111,25 @@ final class SecurityTests: XCTestCase {
                        """
         )
     }
+    
+    /// Tests the renderers behaviour when handling a desired unescaped string.
+    ///
+    /// The renderer is expected to emit the string as-is.
+    func testIgnoringHtmlString() throws {
+        
+        let html = "<script></script>"
+        
+        let view = TestView {
+            Paragraph {
+                HtmlString(html)
+            }
+        }
+        
+        XCTAssertEqual(try renderer.render(view: view),
+                       """
+                       <p><script></script></p>
+                       """
+        )
+    }
 }