MirrorSave
/
budibase
mirror of https://github.com/Budibase/budibase.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fixing issues discovered with hbs escaping.

This commit is contained in:
mike12345567 2021-06-24 11:37:26 +01:00
parent 01bd23f45e
commit a7ce3ada3f
3 changed files with 17 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
packages/server/src/api/controllers/static/templates/app.hbs
View File

@ -1,13 +0,0 @@
<!doctype html>
<html>
<head>
{{{head}}}
</head>
<script>
window["##BUDIBASE_APP_ID##"] = "{{appId}}"
</script>
{{{body}}}
</html>

9
packages/string-templates/src/helpers/index.js
View File

@ -20,10 +20,13 @@ const HELPERS = [
// this help is applied to all statements // this help is applied to all statements
new Helper(HelperFunctionNames.ALL, value => { new Helper(HelperFunctionNames.ALL, value => {
// null/undefined values produce bad results // null/undefined values produce bad results
if (value == null) { if (value == null || typeof value !== "string") {
return "" return value || ""
} }
let text = new SafeString(unescape(value).replace(/&amp;/g, "&")) if (value && value.string) {
value = value.string
}
let text = new SafeString(value.replace(/&amp;/g, "&"))
if (text == null || typeof text !== "string") { if (text == null || typeof text !== "string") {
return text return text
} }

11
packages/string-templates/test/helpers.spec.js
View File

@ -442,4 +442,15 @@ describe("Cover a few complex use cases", () => {
const output = await processObject(input, tableJson) const output = await processObject(input, tableJson)
expect(output.dataProvider).not.toBe("Invalid Binding") expect(output.dataProvider).not.toBe("Invalid Binding")
}) })
it("should be able to handle external ids", async () => {
const input = {
dataProvider: "{{ literal [_id] }}",
}
const context = {
_id: "%5B%221%22%2C%221%22%5D",
}
const output = await processObject(input, context)
expect(output.dataProvider).toBe("%5B%221%22%2C%221%22%5D")
})
}) })