Got escaping of text working, I think.

This commit is contained in:
Alan Johnson
2010-08-12 23:12:26 -04:00
parent 57aadef7c1
commit ad6a53e277
2 changed files with 19 additions and 6 deletions
+13 -5
View File
@@ -2,8 +2,6 @@ Handlebars = {
compile: function(string) {
var compiler = new Handlebars.Compiler(string);
var result = compiler.compile();
console.log("Template: " + string);
console.log("Code: " + result);
return new Function("context", "fallback", "fallback = fallback || {}; var stack = [];var partials = {};" + result);
},
@@ -11,7 +9,16 @@ Handlebars = {
return toString.call(fn) === "[object Function]";
},
escape: function(string) {
escapeText: function(string) {
string = string.replace("'", "\\'");
if (string.slice(-1) == "\\") {
string = string + "\\";
}
return string;
},
escapeExpression: function(string) {
// don't escape SafeStrings, since they're already safe
if (string instanceof Handlebars.SafeString) {
return string.toString();
@@ -179,7 +186,8 @@ Handlebars.Compiler.prototype = {
addText: function() {
if(this.text) {
this.fn = this.fn + "out = out + '" + this.text + "'; ";
console.log("out = out + '" + Handlebars.escapeText(this.text) + "'; ");
this.fn = this.fn + "out = out + \"" + Handlebars.escapeText(this.text) + "\"; ";
this.fn = this.fn + this.newlines;
this.newlines = "";
this.text = "";
@@ -190,7 +198,7 @@ Handlebars.Compiler.prototype = {
var expr = this.lookupFor(mustache);
var escapeCall = "(";
if (this.escaped) {
escapeCall = "Handlebars.escape(";
escapeCall = "Handlebars.escapeExpression(";
}
this.fn += "if (Handlebars.isFunction(" + expr + ")) out = out + " + escapeCall + expr + ".call(Handlebars.buildContext(context, stack))); ";
+6 -1
View File
@@ -26,7 +26,12 @@ test("boolean", function() {
"booleans do not show the contents when false");
});
test("escaping", function() {
test("escaping text", function() {
shouldCompileTo("Awesome's", {}, "Awesome's", "text is escaped so that it doesn't get caught on single quotes");
shouldCompileTo("Awesome\\", {}, "Awesome\\", "text is escaped so that the closing quote can't be ignored");
});
test("escaping expressions", function() {
shouldCompileTo("{{{awesome}}}", {awesome: "&\"\\<>"}, '&\"\\<>',
"expressions with 3 handlebars aren't escaped");