Do we need to escape the value of `data-action`?