Remove Hiccup dependency

project.clj

@@ -4,8 +4,7 @@
   :license {:name "The MIT License"
             :url "http://opensource.org/licenses/MIT"}
   :dependencies [[org.clojure/clojure "1.9.0"]
-                 [crypto-equality "1.0.1"]
-                 [hiccup "1.0.5"]]
+                 [crypto-equality "1.0.1"]]
   :plugins [[lein-codox "0.10.8"]]
   :codox
   {:output-path "codox"

src/ring/util/anti_forgery.clj

@@ -1,12 +1,17 @@
 (ns ring.util.anti-forgery
   "Utility functions for inserting anti-forgery tokens into HTML forms."
-  (:require [hiccup.core :refer [html]]
-            [hiccup.form :refer [hidden-field]]
+  (:require [clojure.string :as str]
             [ring.middleware.anti-forgery :refer [*anti-forgery-token*]]))
 
 (defn anti-forgery-field
   "Create a hidden field with the session anti-forgery token as its value.
   This ensures that the form it's inside won't be stopped by the anti-forgery
   middleware."
   []
-  (html (hidden-field "__anti-forgery-token" (force *anti-forgery-token*))))
+  (str "<input id=\"__anti-forgery-token\" name=\"__anti-forgery-token\""
+       " type=\"hidden\" value=\""
+       (-> (force *anti-forgery-token*)
+           (str/replace "&" "&amp;")
+           (str/replace "\"" "&quot;")
+           (str/replace "<" "&lt;"))
+       "\" />"))

test/ring/util/test/anti_forgery.clj

@@ -7,5 +7,9 @@
   (binding [*anti-forgery-token* "abc"]
     (is (= (anti-forgery-field)
            (str "<input id=\"__anti-forgery-token\" name=\"__anti-forgery-token\""
-                " type=\"hidden\" value=\"abc\" />")))))
+                " type=\"hidden\" value=\"abc\" />"))))
+  (binding [*anti-forgery-token* "<\"&"]
+    (is (= (anti-forgery-field)
+           (str "<input id=\"__anti-forgery-token\" name=\"__anti-forgery-token\""
+                " type=\"hidden\" value=\"&lt;&quot;&amp;\" />")))))