Privacy: Invalid HTML output with customization - "="-Character is added for empty HTML-attributes preceeding the src-attribute

[strobocopter]

Context

No response

Bug description

When adding a <script>-Tag via Customization (e.g. to conditionally load scripts depending on target-environment) the material/privacy plugin can produce invalid HTML-Code.

Example:

{% extends "base.html" %}

{% block extrahead %}
{% if config.extra.add_jquery %}
<script defer src="https://code.jquery.com/jquery-3.7.1.min.js"></script>
{% endif %}
{% endblock %}

This generates the following line in the output HTML-file:

<script defer= src="https://code.jquery.com/jquery-3.7.1.min.js"></script>

This seems to always happen if the <script>-Tag uses attributes without values (e.g. "defer" or "async") and if those attributes are placed before the "src"-attribute. In this case the plugin adds an equals-character to that attribute, but does not set a value, resulting in the browser to assume that "src= ...." is the value for the "defer"-attribute.

Related links

• Documentation for Privacy-Plugin -> not setting found to disable this behavior
• Current Issues -> no issues found that look related

Reproduction

9.5.41-privacy-broken-html.zip

Steps to reproduce

See attached zip-archive...

1. Create empty mkdocs-material project
2. Add material/privacy plugin
3. Add customization HTML that adds a script-Tag
4. Have some attribute without value added to that script-Tag preceeding the src-attribute
5. Run mkdocs build and check the created html-Files

Browser

No response

Before submitting

• I have read and followed the bug reporting guidelines.
• I have attached links to the documentation, and possibly related issues and discussions.
• I assure that I have removed all customizations before submitting this bug report.
• I have attached a .zip file with a minimal reproduction using the built-in info plugin.

[squidfunk]

Thanks for reporting! Now this is funny – I thought we fixed this, but it's actually of the category "how did this ever work", as we're missing a = in the replacement (see fix in cc1508f). The problem stems from our use of a HTML4 parser, which is bundled with Python, and doesn't mandate us to install lxml, which is a dependency with native extensions. For this to work, we must jump through some hoops, including this monkey patch for boolean attributes.

[squidfunk]

Released as part of 9.5.42.