Add support for escape to default render function

hans00 · Nov 27, 2019 · 9b4ef7f · 9b4ef7f
1 parent 838e8c3
commit 9b4ef7f
Show file tree

Hide file tree

Showing 2 changed files with 55 additions and 12 deletions.
diff --git a/README.md b/README.md
@@ -92,11 +92,32 @@ app.listen(3000, err => {
 
 ```js
 // default render function
-function render(_template, _data) {
+function render (_template, _data) {
+  /* eslint no-unused-vars: 0 */
+  function quote (data, type) {
+    if (type) {
+      if (type === String) {
+        return '"' + data.toString().replace(/("|\\)/g, '\\$1') + '"'
+      } else if (type === Number) {
+        return Number(data)
+      } else {
+        return JSON.stringify(data)
+      }
+    } else {
+      return JSON.stringify(data)
+    }
+  }
+  function escapeHTML (data) {
+    return data.toString().replace(/[\u00A0-\u9999<>&]/gim, (i) => `&#${i.charCodeAt(0)};`)
+  }
+  function escapeURL (data) {
+    return encodeURI(data.toString())
+  }
+  /* eslint no-eval: 0 */
   return eval(
-    'const '
-    + Object.keys(_data).map(key => `${key} = ${JSON.stringify(_data[key])}`).join()
-    + ';(`' + _template.toString().replace(/\\/g, '\\\\').replace(/`/g, '\\`') + '`)'
+    'const ' +
+    Object.keys(_data).map(key => `${key} = ${JSON.stringify(_data[key])}`).join() + ';' +
+    '(`' + _template.toString().replace(/(`|\\)/g, '\\$1') + '`)'
   )
 }
 ```

diff --git a/server/index.js b/server/index.js
@@ -14,6 +14,35 @@ if (!process.nextTick) {
 }
 process.on('exit', uWS.free)
 
+function render (_template, _data) {
+  /* eslint no-unused-vars: 0 */
+  function quote (data, type) {
+    if (type) {
+      if (type === String) {
+        return '"' + data.toString().replace(/("|\\)/g, '\\$1') + '"'
+      } else if (type === Number) {
+        return Number(data)
+      } else {
+        return JSON.stringify(data)
+      }
+    } else {
+      return JSON.stringify(data)
+    }
+  }
+  function escapeHTML (data) {
+    return data.toString().replace(/[\u00A0-\u9999<>&]/gim, (i) => `&#${i.charCodeAt(0)};`)
+  }
+  function escapeURL (data) {
+    return encodeURI(data.toString())
+  }
+  /* eslint no-eval: 0 */
+  return eval(
+    'const ' +
+    Object.keys(_data).map(key => `${key} = ${JSON.stringify(_data[key])}`).join() + ';' +
+    '(`' + _template.toString().replace(/(`|\\)/g, '\\$1') + '`)'
+  )
+}
+
 class fastWS {
   constructor ({
     ssl = null,
@@ -32,14 +61,7 @@ class fastWS {
     if (typeof templateRender === 'function') {
       this._templateRender = templateRender
     } else {
-      this._templateRender = function (_template, _data) {
-        /* eslint no-eval: 0 */
-        return global.eval(
-          'const ' +
-          Object.keys(_data).map(key => `${key} = ${JSON.stringify(_data[key])}`).join() +
-          ';(`' + _template.toString().replace(/\\/g, '\\\\').replace(/`/g, '\\`') + '`)'
-        )
-      }
+      this._templateRender = render
     }
     if (typeof cache === 'object' && !(cache instanceof Object)) {
       this._cache = cache