Fixing issues discovered with hbs escaping.

5 years ago · a7ce3ada3f
3 changed files with 17 additions and 16 deletions
--- a/packages/server/src/api/controllers/static/templates/app.hbs
+++ b/packages/server/src/api/controllers/static/templates/app.hbs
@ -1,13 +0,0 @@
-<!doctype html>
-<html>
-
-  <head>   
-    {{{head}}}   
-  </head>
-
-  <script>
-    window["##BUDIBASE_APP_ID##"] = "{{appId}}"
-  </script>
-
-  {{{body}}}
-</html>
--- a/packages/string-templates/src/helpers/index.js
+++ b/packages/string-templates/src/helpers/index.js
@ -20,10 +20,13 @@ const HELPERS = [
  // this help is applied to all statements
  new Helper(HelperFunctionNames.ALL, value => {
    // null/undefined values produce bad results
-    if (value == null) {
-      return ""
+    if (value == null || typeof value !== "string") {
+      return value || ""
    }
-    let text = new SafeString(unescape(value).replace(/&amp;/g, "&"))
+    if (value && value.string) {
+      value = value.string
+    }
+    let text = new SafeString(value.replace(/&amp;/g, "&"))
    if (text == null || typeof text !== "string") {
      return text
    }
--- a/packages/string-templates/test/helpers.spec.js
+++ b/packages/string-templates/test/helpers.spec.js
@ -442,4 +442,15 @@ describe("Cover a few complex use cases", () => {
    const output = await processObject(input, tableJson)
    expect(output.dataProvider).not.toBe("Invalid Binding")
  })
+
+  it("should be able to handle external ids", async () => {
+    const input = {
+      dataProvider: "{{ literal [_id] }}",
+    }
+    const context = {
+      _id: "%5B%221%22%2C%221%22%5D",
+    }
+    const output = await processObject(input, context)
+    expect(output.dataProvider).toBe("%5B%221%22%2C%221%22%5D")
+  })
 })