Fix attribute encoding for new component generation (#311)

gunndabad · web-flow · commit 56fae38adc98 · 2025-04-11T15:06:38.000+01:00
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -9,6 +9,9 @@ The `asp-for` attribute is now obsolete; the `for` attribute should be used in i
 
 ### Fixes
 
+#### Attribute encoding
+Newly-refactored tag helpers now correctly encode their attributes.
+
 #### Source map errors
 The hosted CSS and JavaScript files no longer have source maps.
 Any console errors from browsers failing to download the referenced files should be eliminated.
diff --git a/src/GovUk.Frontend.AspNetCore/ComponentGeneration/ButtonOptions.cs b/src/GovUk.Frontend.AspNetCore/ComponentGeneration/ButtonOptions.cs
@@ -6,7 +6,7 @@ namespace GovUk.Frontend.AspNetCore.ComponentGeneration;
 
 public class ButtonOptions
 {
-    public IHtmlContent? Element { get; set; }
+    public string? Element { get; set; }
     public IHtmlContent? Html { get; set; }
     public string? Text { get; set; }
     public IHtmlContent? Name { get; set; }
@@ -22,14 +22,12 @@ public class ButtonOptions
 
     internal void Validate()
     {
-        var elementStr = Element?.ToHtmlString();
-
-        if (elementStr is not null && elementStr != "a" && elementStr != "button" && elementStr != "input")
+        if (Element is not null && Element != "a" && Element != "button" && Element != "input")
         {
             throw new InvalidOptionsException(GetType(), $"{nameof(Element)} must be 'a', 'button', or 'input'.");
         }
 
-        if (elementStr == "input" && IsStartButton == true)
+        if (Element == "input" && IsStartButton == true)
         {
             throw new InvalidOptionsException(GetType(), $"{nameof(IsStartButton)} cannot be specified for 'input' elements.");
         }
@@ -39,12 +37,12 @@ internal void Validate()
             throw new InvalidOptionsException(GetType(), $"{nameof(PreventDoubleClick)} can only be specified for 'button' or 'input' elements.");
         }
 
-        if (elementStr == "a" && Disabled is not null)
+        if (Element == "a" && Disabled is not null)
         {
             throw new InvalidOptionsException(GetType(), $"{nameof(Disabled)} cannot be specified for 'a' elements.");
         }
 
-        if (Html.NormalizeEmptyString() is not null && elementStr == "input")
+        if (Html.NormalizeEmptyString() is not null && Element == "input")
         {
             throw new InvalidOptionsException(GetType(), $"{nameof(Html)} cannot be specified for 'input' elements.");
         }
@@ -56,5 +54,5 @@ internal void Validate()
     }
 
     internal string GetElement() =>
-        Element?.ToHtmlString().NormalizeEmptyString() ?? (Href.NormalizeEmptyString() is not null ? "a" : "button");
+        Element?.NormalizeEmptyString() ?? (Href.NormalizeEmptyString() is not null ? "a" : "button");
 }
diff --git a/src/GovUk.Frontend.AspNetCore/TagHelpers/BreadcrumbsTagHelper.cs b/src/GovUk.Frontend.AspNetCore/TagHelpers/BreadcrumbsTagHelper.cs
@@ -66,7 +66,7 @@ public override async Task ProcessAsync(TagHelperContext context, TagHelperOutpu
             Classes = classes,
             Attributes = attributes,
             Items = breadcrumbsContext.Items,
-            LabelText = LabelText.ToHtmlContent()
+            LabelText = LabelText.EncodeHtml()
         });
 
         component.WriteTo(output);
diff --git a/src/GovUk.Frontend.AspNetCore/TagHelpers/ButtonLinkTagHelper.cs b/src/GovUk.Frontend.AspNetCore/TagHelpers/ButtonLinkTagHelper.cs
@@ -55,13 +55,13 @@ public override async Task ProcessAsync(TagHelperContext context, TagHelperOutpu
 
         var component = _componentGenerator.GenerateButton(new ButtonOptions()
         {
-            Element = Element.ToHtmlContent(),
+            Element = Element,
             Html = content,
             Href = href,
             Classes = classes,
             Attributes = attributes,
             IsStartButton = IsStartButton,
-            Id = Id.ToHtmlContent()
+            Id = Id.EncodeHtml()
         });
 
         component.WriteTo(output);
diff --git a/src/GovUk.Frontend.AspNetCore/TagHelpers/ButtonTagHelper.cs b/src/GovUk.Frontend.AspNetCore/TagHelpers/ButtonTagHelper.cs
@@ -94,17 +94,17 @@ public override async Task ProcessAsync(TagHelperContext context, TagHelperOutpu
 
         var component = _componentGenerator.GenerateButton(new ButtonOptions()
         {
-            Element = Element.ToHtmlContent(),
+            Element = Element,
             Html = content,
-            Name = Name.ToHtmlContent(),
-            Type = Type.ToHtmlContent(),
-            Value = Value.ToHtmlContent(),
+            Name = Name.EncodeHtml(),
+            Type = Type.EncodeHtml(),
+            Value = Value.EncodeHtml(),
             Disabled = Disabled,
             Classes = classes,
             Attributes = attributes,
             PreventDoubleClick = PreventDoubleClick,
             IsStartButton = IsStartButton,
-            Id = Id.ToHtmlContent()
+            Id = Id.EncodeHtml()
         });
 
         component.WriteTo(output);
diff --git a/src/GovUk.Frontend.AspNetCore/TagHelpers/CharacterCountTagHelper.cs b/src/GovUk.Frontend.AspNetCore/TagHelpers/CharacterCountTagHelper.cs
@@ -253,7 +253,7 @@ public override async Task ProcessAsync(TagHelperContext context, TagHelperOutpu
             await output.GetChildContentAsync();
         }
 
-        var name = ResolveName();
+        var name = ResolveNameUnencoded();
         var id = ResolveId(name);
         var value = ResolveValue(characterCountContext);
         var labelOptions = characterCountContext.GetLabelOptions(For, ViewContext!, _modelHelper, id, AspForAttributeName);
@@ -278,7 +278,7 @@ public override async Task ProcessAsync(TagHelperContext context, TagHelperOutpu
 
         if (Autocomplete is not null)
         {
-            attributes.Add("autocomplete", Autocomplete!.ToHtmlContent()!);
+            attributes.Add("autocomplete", Autocomplete!.EncodeHtml()!);
         }
 
         if (Disabled)
@@ -293,7 +293,7 @@ public override async Task ProcessAsync(TagHelperContext context, TagHelperOutpu
         var component = _componentGenerator.GenerateCharacterCount(new CharacterCountOptions
         {
             Id = id,
-            Name = name,
+            Name = name.EncodeHtml(),
             Rows = Rows,
             Value = value,
             MaxLength = MaxLength,
@@ -325,21 +325,21 @@ public override async Task ProcessAsync(TagHelperContext context, TagHelperOutpu
         if (errorMessageOptions is not null && context.TryGetContextItem<ContainerErrorContext>(out var containerErrorContext))
         {
             Debug.Assert(errorMessageOptions.Html is not null);
-            containerErrorContext.AddError(errorMessageOptions.Html!, href: new HtmlString("#" + id));
+            containerErrorContext.AddError(errorMessageOptions.Html!, href: new HtmlString("#" + id.ToHtmlString()));
         }
     }
 
-    private IHtmlContent ResolveId(IHtmlContent name)
+    private IHtmlContent ResolveId(string nameUnencoded)
     {
         if (Id is not null)
         {
-            return new HtmlString(Id);
+            return Id.EncodeHtml();
         }
 
-        return new HtmlString(TagBuilder.CreateSanitizedId(name.ToHtmlString(), Constants.IdAttributeDotReplacement));
+        return TagBuilder.CreateSanitizedId(nameUnencoded, Constants.IdAttributeDotReplacement).EncodeHtml();
     }
 
-    private IHtmlContent ResolveName()
+    private string ResolveNameUnencoded()
     {
         if (Name is null && For is null)
         {
@@ -348,7 +348,7 @@ private IHtmlContent ResolveName()
                 AspForAttributeName);
         }
 
-        return new HtmlString(Name ?? _modelHelper.GetFullHtmlFieldName(ViewContext!, For!.Name));
+        return Name ?? _modelHelper.GetFullHtmlFieldName(ViewContext!, For!.Name);
     }
 
     private IHtmlContent? ResolveValue(CharacterCountContext characterCountContext)
@@ -358,6 +358,6 @@ private IHtmlContent ResolveName()
             return characterCountContext.Value;
         }
 
-        return For is not null ? new HtmlString(_modelHelper.GetModelValue(ViewContext!, For.ModelExplorer, For.Name)) : null;
+        return For is not null ? _modelHelper.GetModelValue(ViewContext!, For.ModelExplorer, For.Name).EncodeHtml() : null;
     }
 }
diff --git a/src/GovUk.Frontend.AspNetCore/TagHelpers/ErrorMessageTagHelper.cs b/src/GovUk.Frontend.AspNetCore/TagHelpers/ErrorMessageTagHelper.cs
@@ -106,7 +106,7 @@ await output.GetChildContentAsync() :
 
             if (validationMessage != null)
             {
-                resolvedContent = new HtmlString(HtmlEncoder.Default.Encode(validationMessage));
+                resolvedContent = validationMessage.EncodeHtml();
             }
         }
 
diff --git a/src/GovUk.Frontend.AspNetCore/TagHelpers/Extensions.cs b/src/GovUk.Frontend.AspNetCore/TagHelpers/Extensions.cs
@@ -0,0 +1,12 @@
+using System.Diagnostics.CodeAnalysis;
+using System.Text.Encodings.Web;
+using Microsoft.AspNetCore.Html;
+
+namespace GovUk.Frontend.AspNetCore.TagHelpers;
+
+internal static class Extensions
+{
+    [return: NotNullIfNotNull(nameof(value))]
+    public static IHtmlContent? EncodeHtml(this string? value) =>
+        value is not null ? new HtmlString(HtmlEncoder.Default.Encode(value)) : null;
+}
diff --git a/src/GovUk.Frontend.AspNetCore/TagHelpers/FormGroupErrorMessageTagHelper.cs b/src/GovUk.Frontend.AspNetCore/TagHelpers/FormGroupErrorMessageTagHelper.cs
@@ -67,7 +67,7 @@ private protected virtual void SetErrorMessage(TagHelperContent? childContent, T
         else if (context.TryGetContextItem<FormGroupContext2>(out var formGroupContext2))
         {
             formGroupContext2.SetErrorMessage(
-                VisuallyHiddenText.ToHtmlContent(),
+                VisuallyHiddenText.EncodeHtml(),
                 new EncodedAttributesDictionary(output.Attributes),
                 childContent?.Snapshot(),
                 output.TagName);
diff --git a/src/GovUk.Frontend.AspNetCore/TagHelpers/TagHelperExtensions.cs b/src/GovUk.Frontend.AspNetCore/TagHelpers/TagHelperExtensions.cs
diff --git a/src/GovUk.Frontend.AspNetCore/TagHelpers/TextAreaTagHelper.cs b/src/GovUk.Frontend.AspNetCore/TagHelpers/TextAreaTagHelper.cs
@@ -139,10 +139,11 @@ TagBuilder GenerateTextArea(bool haveError)
             var textAreaContext = tagHelperContext.GetContextItem<TextAreaContext>();
 
             var resolvedId = ResolveIdPrefix();
-            var resolvedName = ResolveName();
+            var resolvedName = ResolveNameUnencoded();
 
             var resolvedContent = textAreaContext.Value ??
-                new HtmlString(For != null ? HtmlEncoder.Default.Encode(ModelHelper.GetModelValue(ViewContext!, For.ModelExplorer, For.Name) ?? string.Empty) : string.Empty);
+                ((For != null ? ModelHelper.GetModelValue(ViewContext!, For.ModelExplorer, For.Name) : null) ??
+                    string.Empty).EncodeHtml();
 
             var resolvedTextAreaAttributes = TextAreaAttributes.ToAttributeDictionary();
             resolvedTextAreaAttributes.MergeCssClass("govuk-js-textarea");
@@ -176,12 +177,12 @@ private protected override string ResolveIdPrefix()
                 AspForAttributeName);
         }
 
-        var resolvedName = ResolveName();
+        var resolvedName = ResolveNameUnencoded();
 
         return TagBuilder.CreateSanitizedId(resolvedName, Constants.IdAttributeDotReplacement);
     }
 
-    private string ResolveName()
+    private string ResolveNameUnencoded()
     {
         if (Name == null && For == null)
         {
diff --git a/src/GovUk.Frontend.AspNetCore/TagHelpers/TextInputTagHelper.cs b/src/GovUk.Frontend.AspNetCore/TagHelpers/TextInputTagHelper.cs
@@ -227,7 +227,7 @@ public override async Task ProcessAsync(TagHelperContext context, TagHelperOutpu
             await output.GetChildContentAsync();
         }
 
-        var name = ResolveName();
+        var name = ResolveNameUnencoded();
         var id = ResolveId(name);
         var value = ResolveValue();
         var labelOptions = textInputContext.GetLabelOptions(For, ViewContext!, _modelHelper, id, AspForAttributeName);
@@ -238,7 +238,7 @@ public override async Task ProcessAsync(TagHelperContext context, TagHelperOutpu
 
         if (LabelClass is not null)
         {
-            labelOptions.Classes = new HtmlString(labelOptions.Classes?.ToHtmlString() + " " + LabelClass);
+            labelOptions.Classes = new HtmlString(labelOptions.Classes?.ToHtmlString() + " " + LabelClass.EncodeHtml());
         }
 
         var formGroupAttributes = new EncodedAttributesDictionary(output.Attributes);
@@ -259,23 +259,23 @@ public override async Task ProcessAsync(TagHelperContext context, TagHelperOutpu
         var component = _componentGenerator.GenerateTextInput(new TextInputOptions()
         {
             Id = id,
-            Name = name,
-            Type = Type.ToHtmlContent(),
-            Inputmode = InputMode.ToHtmlContent(),
+            Name = name.EncodeHtml(),
+            Type = Type.EncodeHtml(),
+            Inputmode = InputMode.EncodeHtml(),
             Value = value,
             Disabled = Disabled,
-            DescribedBy = DescribedBy.ToHtmlContent(),
+            DescribedBy = DescribedBy.EncodeHtml(),
             Label = labelOptions,
             Hint = hintOptions,
             ErrorMessage = errorMessageOptions,
             Prefix = prefixOptions,
             Suffix = suffixOptions,
             FormGroup = formGroupOptions,
             Classes = classes,
-            Autocomplete = Autocomplete.ToHtmlContent(),
-            Pattern = Pattern.ToHtmlContent(),
+            Autocomplete = Autocomplete.EncodeHtml(),
+            Pattern = Pattern.EncodeHtml(),
             Spellcheck = Spellcheck,
-            Autocapitalize = Autocapitalize.ToHtmlContent(),
+            Autocapitalize = Autocapitalize.EncodeHtml(),
             InputWrapper = new TextInputOptionsInputWrapper()
             {
                 Classes = inputWrapperClasses,
@@ -289,21 +289,21 @@ public override async Task ProcessAsync(TagHelperContext context, TagHelperOutpu
         if (errorMessageOptions is not null && context.TryGetContextItem<ContainerErrorContext>(out var containerErrorContext))
         {
             Debug.Assert(errorMessageOptions.Html is not null);
-            containerErrorContext.AddError(errorMessageOptions.Html!, href: new HtmlString("#" + id));
+            containerErrorContext.AddError(errorMessageOptions.Html!, href: new HtmlString("#" + id.ToHtmlString()));
         }
     }
 
-    private IHtmlContent ResolveId(IHtmlContent name)
+    private IHtmlContent ResolveId(string nameUnencoded)
     {
         if (Id is not null)
         {
-            return new HtmlString(Id);
+            return Id.EncodeHtml();
         }
 
-        return new HtmlString(TagBuilder.CreateSanitizedId(name.ToHtmlString(), Constants.IdAttributeDotReplacement));
+        return TagBuilder.CreateSanitizedId(nameUnencoded, Constants.IdAttributeDotReplacement).EncodeHtml();
     }
 
-    private IHtmlContent ResolveName()
+    private string ResolveNameUnencoded()
     {
         if (Name is null && For is null)
         {
@@ -312,16 +312,16 @@ private IHtmlContent ResolveName()
                 AspForAttributeName);
         }
 
-        return new HtmlString(Name ?? _modelHelper.GetFullHtmlFieldName(ViewContext!, For!.Name));
+        return Name ?? _modelHelper.GetFullHtmlFieldName(ViewContext!, For!.Name);
     }
 
     private IHtmlContent? ResolveValue()
     {
         if (_valueSpecified)
         {
-            return new HtmlString(_value);
+            return _value.EncodeHtml();
         }
 
-        return For is not null ? new HtmlString(_modelHelper.GetModelValue(ViewContext!, For.ModelExplorer, For.Name)) : null;
+        return For is not null ? _modelHelper.GetModelValue(ViewContext!, For.ModelExplorer, For.Name).EncodeHtml() : null;
     }
 }
diff --git a/tests/GovUk.Frontend.AspNetCore.Tests/TagHelpers/ButtonLinkTagHelperTests.cs b/tests/GovUk.Frontend.AspNetCore.Tests/TagHelpers/ButtonLinkTagHelperTests.cs
@@ -58,7 +58,7 @@ public async Task ProcessAsync_InvokesComponentGeneratorWithExpectedOptions()
 
         // Assert
         Assert.NotNull(actualOptions);
-        Assert.Equal("a", actualOptions!.Element?.ToHtmlString());
+        Assert.Equal("a", actualOptions!.Element);
         Assert.Equal(content, actualOptions.Html?.ToHtmlString());
         Assert.Null(actualOptions.Text);
         Assert.Null(actualOptions.Name);
diff --git a/tests/GovUk.Frontend.AspNetCore.Tests/TagHelpers/ButtonTagHelperTests.cs b/tests/GovUk.Frontend.AspNetCore.Tests/TagHelpers/ButtonTagHelperTests.cs
@@ -66,7 +66,7 @@ public async Task ProcessAsync_InvokesComponentGeneratorWithExpectedOptions()
 
         // Assert
         Assert.NotNull(actualOptions);
-        Assert.Equal("button", actualOptions!.Element?.ToHtmlString());
+        Assert.Equal("button", actualOptions!.Element);
         Assert.Equal(HtmlEncoder.Default.Encode(content), actualOptions.Html?.ToHtmlString());
         Assert.Null(actualOptions.Text);
         Assert.Equal(name, actualOptions.Name?.ToHtmlString());

Original file line number	Diff line number	Diff line change
`@@ -6,7 +6,7 @@ namespace GovUk.Frontend.AspNetCore.ComponentGeneration;`
`6`	`6`
`7`	`7`	`public class ButtonOptions`
`8`	`8`	`{`
`9`		`- public IHtmlContent? Element { get; set; }`
	`9`	`+ public string? Element { get; set; }`
`10`	`10`	`public IHtmlContent? Html { get; set; }`
`11`	`11`	`public string? Text { get; set; }`
`12`	`12`	`public IHtmlContent? Name { get; set; }`
`@@ -22,14 +22,12 @@ public class ButtonOptions`
`22`	`22`
`23`	`23`	`internal void Validate()`
`24`	`24`	`{`
`25`		`- var elementStr = Element?.ToHtmlString();`
`26`		`-`
`27`		`- if (elementStr is not null && elementStr != "a" && elementStr != "button" && elementStr != "input")`
	`25`	`+ if (Element is not null && Element != "a" && Element != "button" && Element != "input")`
`28`	`26`	`{`
`29`	`27`	`throw new InvalidOptionsException(GetType(), $"{nameof(Element)} must be 'a', 'button', or 'input'.");`
`30`	`28`	`}`
`31`	`29`
`32`		`- if (elementStr == "input" && IsStartButton == true)`
	`30`	`+ if (Element == "input" && IsStartButton == true)`
`33`	`31`	`{`
`34`	`32`	`throw new InvalidOptionsException(GetType(), $"{nameof(IsStartButton)} cannot be specified for 'input' elements.");`
`35`	`33`	`}`
`@@ -39,12 +37,12 @@ internal void Validate()`
`39`	`37`	`throw new InvalidOptionsException(GetType(), $"{nameof(PreventDoubleClick)} can only be specified for 'button' or 'input' elements.");`
`40`	`38`	`}`
`41`	`39`
`42`		`- if (elementStr == "a" && Disabled is not null)`
	`40`	`+ if (Element == "a" && Disabled is not null)`
`43`	`41`	`{`
`44`	`42`	`throw new InvalidOptionsException(GetType(), $"{nameof(Disabled)} cannot be specified for 'a' elements.");`
`45`	`43`	`}`
`46`	`44`
`47`		`- if (Html.NormalizeEmptyString() is not null && elementStr == "input")`
	`45`	`+ if (Html.NormalizeEmptyString() is not null && Element == "input")`
`48`	`46`	`{`
`49`	`47`	`throw new InvalidOptionsException(GetType(), $"{nameof(Html)} cannot be specified for 'input' elements.");`
`50`	`48`	`}`
`@@ -56,5 +54,5 @@ internal void Validate()`
`56`	`54`	`}`
`57`	`55`
`58`	`56`	`internal string GetElement() =>`
`59`		`- Element?.ToHtmlString().NormalizeEmptyString() ?? (Href.NormalizeEmptyString() is not null ? "a" : "button");`
	`57`	`+ Element?.NormalizeEmptyString() ?? (Href.NormalizeEmptyString() is not null ? "a" : "button");`
`60`	`58`	`}`
Original file line number	Diff line number	Diff line change
`@@ -253,7 +253,7 @@ public override async Task ProcessAsync(TagHelperContext context, TagHelperOutpu`
`253`	`253`	`await output.GetChildContentAsync();`
`254`	`254`	`}`
`255`	`255`
`256`		`- var name = ResolveName();`
	`256`	`+ var name = ResolveNameUnencoded();`
`257`	`257`	`var id = ResolveId(name);`
`258`	`258`	`var value = ResolveValue(characterCountContext);`
`259`	`259`	`var labelOptions = characterCountContext.GetLabelOptions(For, ViewContext!, _modelHelper, id, AspForAttributeName);`
`@@ -278,7 +278,7 @@ public override async Task ProcessAsync(TagHelperContext context, TagHelperOutpu`
`278`	`278`
`279`	`279`	`if (Autocomplete is not null)`
`280`	`280`	`{`
`281`		`- attributes.Add("autocomplete", Autocomplete!.ToHtmlContent()!);`
	`281`	`+ attributes.Add("autocomplete", Autocomplete!.EncodeHtml()!);`
`282`	`282`	`}`
`283`	`283`
`284`	`284`	`if (Disabled)`
`@@ -293,7 +293,7 @@ public override async Task ProcessAsync(TagHelperContext context, TagHelperOutpu`
`293`	`293`	`var component = _componentGenerator.GenerateCharacterCount(new CharacterCountOptions`
`294`	`294`	`{`
`295`	`295`	`Id = id,`
`296`		`- Name = name,`
	`296`	`+ Name = name.EncodeHtml(),`
`297`	`297`	`Rows = Rows,`
`298`	`298`	`Value = value,`
`299`	`299`	`MaxLength = MaxLength,`
`@@ -325,21 +325,21 @@ public override async Task ProcessAsync(TagHelperContext context, TagHelperOutpu`
`325`	`325`	`if (errorMessageOptions is not null && context.TryGetContextItem<ContainerErrorContext>(out var containerErrorContext))`
`326`	`326`	`{`
`327`	`327`	`Debug.Assert(errorMessageOptions.Html is not null);`
`328`		`- containerErrorContext.AddError(errorMessageOptions.Html!, href: new HtmlString("#" + id));`
	`328`	`+ containerErrorContext.AddError(errorMessageOptions.Html!, href: new HtmlString("#" + id.ToHtmlString()));`
`329`	`329`	`}`
`330`	`330`	`}`
`331`	`331`
`332`		`- private IHtmlContent ResolveId(IHtmlContent name)`
	`332`	`+ private IHtmlContent ResolveId(string nameUnencoded)`
`333`	`333`	`{`
`334`	`334`	`if (Id is not null)`
`335`	`335`	`{`
`336`		`- return new HtmlString(Id);`
	`336`	`+ return Id.EncodeHtml();`
`337`	`337`	`}`
`338`	`338`
`339`		`- return new HtmlString(TagBuilder.CreateSanitizedId(name.ToHtmlString(), Constants.IdAttributeDotReplacement));`
	`339`	`+ return TagBuilder.CreateSanitizedId(nameUnencoded, Constants.IdAttributeDotReplacement).EncodeHtml();`
`340`	`340`	`}`
`341`	`341`
`342`		`- private IHtmlContent ResolveName()`
	`342`	`+ private string ResolveNameUnencoded()`
`343`	`343`	`{`
`344`	`344`	`if (Name is null && For is null)`
`345`	`345`	`{`
`@@ -348,7 +348,7 @@ private IHtmlContent ResolveName()`
`348`	`348`	`AspForAttributeName);`
`349`	`349`	`}`
`350`	`350`
`351`		`- return new HtmlString(Name ?? _modelHelper.GetFullHtmlFieldName(ViewContext!, For!.Name));`
	`351`	`+ return Name ?? _modelHelper.GetFullHtmlFieldName(ViewContext!, For!.Name);`
`352`	`352`	`}`
`353`	`353`
`354`	`354`	`private IHtmlContent? ResolveValue(CharacterCountContext characterCountContext)`
`@@ -358,6 +358,6 @@ private IHtmlContent ResolveName()`
`358`	`358`	`return characterCountContext.Value;`
`359`	`359`	`}`
`360`	`360`
`361`		`- return For is not null ? new HtmlString(_modelHelper.GetModelValue(ViewContext!, For.ModelExplorer, For.Name)) : null;`
	`361`	`+ return For is not null ? _modelHelper.GetModelValue(ViewContext!, For.ModelExplorer, For.Name).EncodeHtml() : null;`
`362`	`362`	`}`
`363`	`363`	`}`
Original file line number	Diff line number	Diff line change
`@@ -106,7 +106,7 @@ await output.GetChildContentAsync() :`
`106`	`106`
`107`	`107`	`if (validationMessage != null)`
`108`	`108`	`{`
`109`		`- resolvedContent = new HtmlString(HtmlEncoder.Default.Encode(validationMessage));`
	`109`	`+ resolvedContent = validationMessage.EncodeHtml();`
`110`	`110`	`}`
`111`	`111`	`}`
`112`	`112`
Original file line number	Diff line number	Diff line change
`@@ -67,7 +67,7 @@ private protected virtual void SetErrorMessage(TagHelperContent? childContent, T`
`67`	`67`	`else if (context.TryGetContextItem<FormGroupContext2>(out var formGroupContext2))`
`68`	`68`	`{`
`69`	`69`	`formGroupContext2.SetErrorMessage(`
`70`		`- VisuallyHiddenText.ToHtmlContent(),`
	`70`	`+ VisuallyHiddenText.EncodeHtml(),`
`71`	`71`	`new EncodedAttributesDictionary(output.Attributes),`
`72`	`72`	`childContent?.Snapshot(),`
`73`	`73`	`output.TagName);`