Stringify things before calling escapeHtml on them in case their stringified representation contains HTML

[sethkinast]

This prevents a potential XSS attack.

Closes #449

[smfoote]

Looks good.

[jimmyhchan]

would it be too paranoid to do:

typeof s === 'object' && Array.prototype.toString.call(s)

I'm not sure what happens if s is an object with the key toString or a function literal... it's a similar problem to context = [] and we try to reference context.sort . mildly related to #469

[sethkinast]

That's actually an intended case. If an Object has a toString method, I
want to invoke it. That gives you the potential to output a stringified
version of your special object as a Dust reference instead of getting
[object Object]

If you're worried about Objects having a property called toString, I
could additionally check that toString is a function first.

On Fri, Jan 9, 2015 at 5:09 PM, jimmyhchan notifications@github.com wrote:

In lib/dust.js
#534 (diff):

@@ -849,7 +849,10 @@
SQUOT = /'/g;

dust.escapeHtml = function(s) {

• if (typeof s === 'string') {
• if (typeof s === "string" || (s && s.toString)) {

would it be too paranoid to do:

typeof s === 'object' && Array.prototype.toString.call(s)

I'm not sure what happens if s is an object with the key toString or a
function literal... it's a similar problem to context = [] and we try to
reference context.sort . mildly related to #469
#469

—
Reply to this email directly or view it on GitHub
https://github.com/linkedin/dustjs/pull/534/files#r22754126.

Seth Kinast
http://sethkinast.com/

[sethkinast]

Updated to make sure .toString is a function and not just a property.