mirror of
https://github.com/meteor/meteor.git
synced 2026-05-02 03:01:46 -04:00
84b123ef44
This syntax has a bug where it relies on having html5-tokenizer on the client, code which was written for the server (and uses Function.bind, defineGetter, etc.).
The plan is to deprecate/remove this syntax anyway, i.e. not allow
you to say `<x {{{attrs}}}>` and then have `attrs` evaluate to a string like
'key1="value1" key2="value2"' at runtime. Constructing these strings is error-prone and likely to be insecure.
Instead, you'll have your choice of double-stache in an attribute value, with or without quotes (`<a b={{c}}>`, or `<a b="{{c}} {{d}}"`, or even `<a b={{c}}-{{d}}>`), or double-stache at the top level of a tag, as in `<a {{b}}>`, in which case `b` must be either a dictionary of attribute names and values or a string containing at most a single attribute name (e.g. "selected" or "").