[SLING-7024] Sightly doesn't allow to emit style or on event attributes for data-sly-attribute

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: Scripting HTL Compiler 1.0.8
• Fix Version/s: Scripting HTL Compiler 1.0.10
• Component/s: Scripting
• Assignee: Radu Cotescu
• Reporter: Konrad Windszus
• Created: 31/Jul/17 09:35
• Updated: 07/Aug/17 09:40
• Resolved: 01/Aug/17 10:16

Description

For the following Sightly script

<a data-sly-attribute.style="${'background-color: #00ff00' @ context='style-token'}"></a>

The generated a element will not contain a style attribute.
Instead the following error is emitted in the log

31.07.2017 09:26:12.448 *WARN* [172.19.0.1 [1501493172400] GET /<some URL> HTTP/1.1] org.apache.sling.scripting.sightly.impl.engine.SightlyScriptEngine Script <some script path> 11:32: ${'background-color: #00ff00' @ context='style-token'}: Refusing to generate attribute 'style' for security reasons.

This is unexpected as neither the HTL spec (https://github.com/Adobe-Marketing-Cloud/htl-spec/blob/master/SPECIFICATION.md#223-attribute) nor the adobe documentation at https://docs.adobe.com/docs/en/htl/docs/block-statements.html#attribute mentions that. Please either document that or rather lift that limitation.

Issue Links

• is a clone of: SLING-5944 Sightly doesn't allow to overwrite the context for `data-sly-element`
• relates to: SLING-6866 HTL doesn't allow to overwrite the context for data-sly-text