Stringify things before calling escapeHtml on them in case their stri…

…ngified representation contains HTML. This prevents a potential XSS attack. Closes #449
linkedin · Jan 9, 2015 · 07344c0 · 07344c0
1 parent 0e0fcbb
commit 07344c0
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 1 deletion.
diff --git a/lib/dust.js b/lib/dust.js
@@ -849,7 +849,10 @@
       SQUOT  = /\'/g;
 
   dust.escapeHtml = function(s) {
-    if (typeof s === 'string') {
+    if (typeof s === "string" || (s && s.toString)) {
+      if (typeof s !== "string") {
+        s = s.toString();
+      }
       if (!HCHARS.test(s)) {
         return s;
       }

diff --git a/test/jasmine-test/spec/coreTests.js b/test/jasmine-test/spec/coreTests.js
@@ -688,6 +688,13 @@ var coreTests = [
 		 },
 	expected: "1",
 	message: "should test using a multilevel reference as a key in array access"
+      },
+      {
+	name: "Outputting an array calls toString and HTML-encodes",
+	source: "{array}",
+	context: { "array": ["You & I", " & Moe"] },
+	expected: "You &amp; I, &amp; Moe",
+	message: "should HTML-encode stringified arrays referenced directly"
       }
     ]
   },