Non-Boolean Attribute Without Value
ID |
html.attr_value_not_empty |
Severity |
low |
Remediation Complexity |
trivial |
Remediation Risk |
low |
Remediation Effort |
low |
Resource |
Reliability |
Language |
Html |
Tags |
reliability |
Rationale
An attribute such as href or title written without a value has the empty string as its value and
silently does nothing useful, so <a href> or <input title> is almost always a typo where the
value was dropped.
Only a name HTML defines as taking a value is reported. Three groups are therefore left alone:
-
Boolean attributes such as
disabled,requiredandchecked, whose mere presence carries the meaning; and the attributes whose empty string is a state of their own rather than a dropped value —contenteditable,sandbox,download,crossorigin,popover,spellcheck,translate,autocapitalizeand the decorative-imagealt. -
data-*, whose name and values belong to the author, and anaria-name that is not a real ARIA state or property. -
Any name HTML does not define. A bare name is the normal spelling of an attribute-selector directive or a component API —
<td mat-cell>,<input matInput>,<div #myChart>,<app-panel section-actions>— and nothing follows from such a name being written without a value. A namespaced name such asth:textis left alone for the same reason.
Document prologues are skipped: a lowercase <!doctype html> and an XML declaration are handed over
shaped like elements, but the words of the declaration are not attributes of a tag.
<a href>link</a> <!-- FLAW - href has no value -->
<button onclick>Go</button> <!-- FLAW - the handler was dropped -->
<a href="/home">link</a> <!-- OK - href has a value -->
<input type="text" disabled> <!-- OK - boolean attribute -->
<iframe src="a.html" sandbox> <!-- OK - empty sandbox means every restriction -->
<td mat-cell></td> <!-- OK - a directive selector, not an HTML attribute -->Remediation
Give the attribute the value it needs, or remove it if it serves no purpose. Leave only true boolean attributes bare.