Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Escape single quote (') characters as ' #11

Closed
wants to merge 1 commit into from
Closed

Escape single quote (') characters as ' #11

wants to merge 1 commit into from

Conversation

RyanGlScott
Copy link
Contributor

This backports the upstream change made to stache in stackbuilders/stache#36. This fix is necessary to solve a criterion bug (haskell/criterion#202) in which single quotes are not escaped when substituted into criterion's HTML template, causing browsers to display the report's contents incorrectly.

This backports the upstream change made to `stache` in
stackbuilders/stache#36. This fix is necessary to solve a `criterion`
bug (haskell/criterion#202) in which single quotes are not escaped when
substituted into `criterion`'s HTML template, causing browsers to
display the report's contents incorrectly.
@phadej
Copy link
Collaborator

phadej commented Sep 16, 2018

There's mustache/spec#69

  • Specification doesn't have negative tests (which is unfortunate)
  • I'd like to preserve spec compliant behavior, even it's arguably silly
  • So one way to fix criterion is
-  var ylabels = [{{#report}}[-{{number}},'<a href="#b{{number}}">{{name}}</a>'],{{/report}}]
+  var ylabels = [{{#report}}[-{{number}},"<a href=\"#b{{number}}\">{{name}}</a>"],{{/report}}]

Additionally, I'm open to adding renderMustacheWithEscape so user of the library could supply their own escapeHtml variant.

@RyanGlScott
Copy link
Contributor Author

Bah, I was afraid that something in the mustache specification would get in the way. (I even charged ahead and changed stache before I knew about this... oh well.)

In that case, I think your suggested fix of simply using double quotes instead of single quotes is the cleanest one.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants