Mirrors/lodash
1
0
Fork 0
mirror of https://github.com/whoisclebs/lodash.git synced 2026-02-04 08:57:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Templates should not reference _.escape if "escape" delimiters are not used. [closes #484]

Browse Source
This commit is contained in:
John-David Dalton
2014-02-20 22:31:42 -08:00
parent b79d03d9a4
commit 8a1d2b614a
8 changed files with 104 additions and 82 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
test/test.js
View File

@@ -7482,14 +7482,12 @@
QUnit.module('lodash.template');
(function() {
test('should interpolate data object properties', 1, function() {
var compiled = _.template('<%= a %>BC');
equal(compiled({ 'a': 'A' }), 'ABC');
});
test('should escape values in "escape" delimiters', 1, function() {
var escaped = '<p>&amp;&lt;&gt;&quot;&#39;\/</p>',
unescaped = '&<>"\'\/';
test('should support escaped values in "interpolation" delimiters', 1, function() {
var compiled = _.template('<%= a ? "a=\\"A\\"" : "" %>');
equal(compiled({ 'a': true }), 'a="A"');
var compiled = _.template('<p><%- value %></p>');
equal(compiled({ 'value': unescaped }), escaped);
});
test('should evaluate JavaScript in "evaluate" delimiters', 1, function() {
@@ -7504,12 +7502,14 @@
equal(actual, '<ul><li>A</li><li>B</li></ul>');
});
test('should escape values in "escape" delimiters', 1, function() {
var escaped = '<p>&amp;&lt;&gt;&quot;&#39;\/</p>',
unescaped = '&<>"\'\/';
test('should interpolate data object properties', 1, function() {
var compiled = _.template('<%= a %>BC');
equal(compiled({ 'a': 'A' }), 'ABC');
});
var compiled = _.template('<p><%- value %></p>');
equal(compiled({ 'value': unescaped }), escaped);
test('should support escaped values in "interpolation" delimiters', 1, function() {
var compiled = _.template('<%= a ? "a=\\"A\\"" : "" %>');
equal(compiled({ 'a': true }), 'a="A"');
});
test('should work with "interpolate" delimiters containing ternary operators', 1, function() {
@@ -7568,6 +7568,11 @@
equal(_.template('${"{" + value + "\\}"}', data), '{2}');
});
test('should not reference `_.escape` when "escape" delimiters are not used', 1, function() {
var compiled = _.template('<%= typeof __e %>');
equal(compiled({}), 'undefined');
});
test('should allow referencing variables declared in "evaluate" delimiters from other delimiters', 1, function() {
var compiled = _.template('<% var b = a; %><%= b.value %>'),
data = { 'a': { 'value': 1 } };