Got escaping of text working, I think.
This commit is contained in:
+13
-5
@@ -2,8 +2,6 @@ Handlebars = {
|
||||
compile: function(string) {
|
||||
var compiler = new Handlebars.Compiler(string);
|
||||
var result = compiler.compile();
|
||||
console.log("Template: " + string);
|
||||
console.log("Code: " + result);
|
||||
return new Function("context", "fallback", "fallback = fallback || {}; var stack = [];var partials = {};" + result);
|
||||
},
|
||||
|
||||
@@ -11,7 +9,16 @@ Handlebars = {
|
||||
return toString.call(fn) === "[object Function]";
|
||||
},
|
||||
|
||||
escape: function(string) {
|
||||
escapeText: function(string) {
|
||||
string = string.replace("'", "\\'");
|
||||
if (string.slice(-1) == "\\") {
|
||||
string = string + "\\";
|
||||
}
|
||||
|
||||
return string;
|
||||
},
|
||||
|
||||
escapeExpression: function(string) {
|
||||
// don't escape SafeStrings, since they're already safe
|
||||
if (string instanceof Handlebars.SafeString) {
|
||||
return string.toString();
|
||||
@@ -179,7 +186,8 @@ Handlebars.Compiler.prototype = {
|
||||
|
||||
addText: function() {
|
||||
if(this.text) {
|
||||
this.fn = this.fn + "out = out + '" + this.text + "'; ";
|
||||
console.log("out = out + '" + Handlebars.escapeText(this.text) + "'; ");
|
||||
this.fn = this.fn + "out = out + \"" + Handlebars.escapeText(this.text) + "\"; ";
|
||||
this.fn = this.fn + this.newlines;
|
||||
this.newlines = "";
|
||||
this.text = "";
|
||||
@@ -190,7 +198,7 @@ Handlebars.Compiler.prototype = {
|
||||
var expr = this.lookupFor(mustache);
|
||||
var escapeCall = "(";
|
||||
if (this.escaped) {
|
||||
escapeCall = "Handlebars.escape(";
|
||||
escapeCall = "Handlebars.escapeExpression(";
|
||||
}
|
||||
|
||||
this.fn += "if (Handlebars.isFunction(" + expr + ")) out = out + " + escapeCall + expr + ".call(Handlebars.buildContext(context, stack))); ";
|
||||
|
||||
+6
-1
@@ -26,7 +26,12 @@ test("boolean", function() {
|
||||
"booleans do not show the contents when false");
|
||||
});
|
||||
|
||||
test("escaping", function() {
|
||||
test("escaping text", function() {
|
||||
shouldCompileTo("Awesome's", {}, "Awesome's", "text is escaped so that it doesn't get caught on single quotes");
|
||||
shouldCompileTo("Awesome\\", {}, "Awesome\\", "text is escaped so that the closing quote can't be ignored");
|
||||
});
|
||||
|
||||
test("escaping expressions", function() {
|
||||
shouldCompileTo("{{{awesome}}}", {awesome: "&\"\\<>"}, '&\"\\<>',
|
||||
"expressions with 3 handlebars aren't escaped");
|
||||
|
||||
|
||||
Reference in New Issue
Block a user