Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Html entities are decoded in array but not in string #449

Closed
feliperuiz opened this issue Mar 31, 2014 · 2 comments · Fixed by #534
Closed

Html entities are decoded in array but not in string #449

feliperuiz opened this issue Mar 31, 2014 · 2 comments · Fixed by #534

Comments

@feliperuiz
Copy link

I just stumbled upon this issue and I honestly couldn't understand why this happens. Let's say you have a template like

<ul>{~n}
{#section}
    <li>{name}</li>{~n}
{/section}
</ul>

and the data to render is

{
    "section" : [
        {
            "name" : "Test &amp; more test"
        },
        {
            "name" : ["Another test &amp; testing stuff"]
        }
    ]
}

If we render it like so, the first li will have the value Test &amp; more test, but the second one will render Another test & testing stuff. Why do the two behave differently? In my head they should behave the same way, but I can't for the life of me find what causes that difference.

You can see it in action in this fiddle.

@jimmyhchan
Copy link
Contributor

the first name does htmlEncoding on htmlEntities so you get double encoding
the second name is doing a toString on the array and using that.

as another example:

{
    "section" : [
        {
            "name" : "Test &amp; more test"
        },
        {
            "name" : {}
        }
    ]
}

will return the second name as [object object] because you are pointing directly to an object.

It just so happens that toString on an array gives you the concatenated values in the array. Which might be expected as much as [object object] is expected.

@feliperuiz
Copy link
Author

Shouldn't it escape the result of the toString call then, so they have the same behaviour?

sethkinast pushed a commit to sethkinast/dustjs that referenced this issue Jan 9, 2015
…ngified representation contains HTML.

This prevents a potential XSS attack.

Closes linkedin#449
sethkinast pushed a commit to sethkinast/dustjs that referenced this issue Jan 14, 2015
…ngified representation contains HTML.

This prevents a potential XSS attack.

Closes linkedin#449
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
2 participants