Fix attributes option ignoring values passed from the safe filter

[querkmachine]

Updates the govukAttributes macro to, when passed a set of key-value pairs, check if the value is an object that matches the shape of those returned by Nunjucks' safe filter (i.e. an object with val and length keys).

If found, that object's val is used in place of the object. Previously, this would just be lost and the macro would return an empty string.

If the value is an object that doesn't have those specific keys, it is instead treated as one of our attribute configuration objects (which use the keys value and optional instead).

Resolves #4937.

Changes

• Adds a check at the start of the govukAttributes attribute loop to look for objects resembling the output of the safe filter. If matched, the object's val value is mapped to the macro's working value.
• Adds a test to ensure that values passed via the safe filter are output by the macro as expected.

Thoughts

Checking for the existence of two keys is definitely not a foolproof way of ensuring that the object is actually one returned by the safe filter, however I'm not sure there is a more obvious way of detecting its use.

This does not create output that perfectly matches the expected output in #4937, as HTML is still returned escaped even if safe is used by the author. This is because the macro indiscriminately escapes all of the attributes and values it outputs.

[github-actions]

📋 Stats

File sizes

File	Size
dist/govuk-frontend-development.min.css	113.24 KiB
dist/govuk-frontend-development.min.js	42.21 KiB
packages/govuk-frontend/dist/govuk/all.bundle.js	87.21 KiB
packages/govuk-frontend/dist/govuk/all.bundle.mjs	81.95 KiB
packages/govuk-frontend/dist/govuk/all.mjs	4.17 KiB
packages/govuk-frontend/dist/govuk/govuk-frontend-component.mjs	359 B
packages/govuk-frontend/dist/govuk/govuk-frontend.min.css	113.23 KiB
packages/govuk-frontend/dist/govuk/govuk-frontend.min.js	42.2 KiB
packages/govuk-frontend/dist/govuk/i18n.mjs	5.55 KiB

Modules

File	Size (bundled)	Size (minified)
all.mjs	77.67 KiB	40.19 KiB
accordion.mjs	22.71 KiB	12.85 KiB
button.mjs	5.98 KiB	2.69 KiB
character-count.mjs	22.4 KiB	9.92 KiB
checkboxes.mjs	5.83 KiB	2.83 KiB
error-summary.mjs	7.89 KiB	3.46 KiB
exit-this-page.mjs	17.1 KiB	9.26 KiB
header.mjs	4.46 KiB	2.6 KiB
notification-banner.mjs	6.26 KiB	2.62 KiB
password-input.mjs	15.15 KiB	7.25 KiB
radios.mjs	4.83 KiB	2.38 KiB
skip-link.mjs	4.39 KiB	2.18 KiB
tabs.mjs	10.13 KiB	6.11 KiB

View stats and visualisations on the review app

---

Action run for fe7a019

[romaricpascal]

Thanks for the speedy fix. The solution looks very fine to me, I'm not sure if we'd have access to the SafeString class to check types anyway (and trying to check the type could lead to subtle issues, which would complicate our testing).

Thinking we can explore the forced escaping in another PR if we get feedback it causes issues.

[querkmachine]

I'll see about raising another issue specifically about using safe to return unescaped values, but that's definitely a much lower priority than this fix.