Hugo: safeHTML still processes '+'

[pauby]

I raised a message in the support forums regarding safeHTML still processing any '+' characters in a string and replacing it with '%2b'. The following code:

config.toml:
googlefonts = [ "Bitter", "Source+Sans+Pro" ]

header.html:

{{ range .Site.Params.Appearance.googlefonts }}    
  <link rel="stylesheet" href="//fonts.googleapis.com/css?family={{ . |  safeHTML }}" type="text/css" media="all" />    
{{ end }}

OR

{{ range .Site.Params.Appearance.googlefonts }}    
  <link rel="stylesheet" href="//fonts.googleapis.com/css?family={{ replace . "%2b" "+" |  safeHTML }}" type="text/css" media="all" />    
{{ end }}

Renders to:

<link rel="stylesheet" href="//fonts.googleapis.com/css?family=Source%2bSans%2bPro" type="text/css" media="all" />

No matter what combination of 'Source Sans Pro' I use (spaces, underscores etc. all being replaced with '+' in the code) I always get the same render.

It looks very much like safeHTML simply ignores '+' being safe and converts them to their HTML code anyway.

[bep]

As this is presented, I think this belongs on the discussion forum. safeHTML does nothing more than to mark the value as "safe HTML" for the Go template parser.

What do you say @moorereason ?

[pauby]

So the Go template parser is at fault? This has been in the support forum (as I said) with no 'fix'.

[rdwatters]

@pauby FWIW, you don't need the + sign in your use case:

https://fonts.googleapis.com/css?family=Source%20Sans%20Pro

[moorereason]

@pauby, this belongs on the forums. It's not a bug. Essentially, you need to pass the entire attribute or tag to safeHTMLAttr or safeHTML.