Fixing issues discovered with hbs escaping.

5 years ago · a7ce3ada3f
3 changed files with 17 additions and 16 deletions
--- a/packages/server/src/api/controllers/static/templates/app.hbs
+++ b/packages/server/src/api/controllers/static/templates/app.hbs
@ -1,13 +0,0 @@
 <!doctype html>
 <html>
  <head>   
    {{{head}}}   
  </head>
  <script>
    window["##BUDIBASE_APP_ID##"] = "{{appId}}"
  </script>
  {{{body}}}
 </html>
--- a/packages/string-templates/src/helpers/index.js
+++ b/packages/string-templates/src/helpers/index.js
@ -20,10 +20,13 @@ const HELPERS = [
  // this help is applied to all statements
  new Helper(HelperFunctionNames.ALL, value => {
    // null/undefined values produce bad results
-    if (value == null) {
+    if (value == null || typeof value !== "string") {
-      return ""
+      return value || ""
    }
-    let text = new SafeString(unescape(value).replace(/&amp;/g, "&"))
+    if (value && value.string) {
      value = value.string
    }
    let text = new SafeString(value.replace(/&amp;/g, "&"))
    if (text == null || typeof text !== "string") {
      return text
    }
--- a/packages/string-templates/test/helpers.spec.js
+++ b/packages/string-templates/test/helpers.spec.js
@ -442,4 +442,15 @@ describe("Cover a few complex use cases", () => {
    const output = await processObject(input, tableJson)
    expect(output.dataProvider).not.toBe("Invalid Binding")
  })
  it("should be able to handle external ids", async () => {
    const input = {
      dataProvider: "{{ literal [_id] }}",
    }
    const context = {
      _id: "%5B%221%22%2C%221%22%5D",
    }
    const output = await processObject(input, context)
    expect(output.dataProvider).toBe("%5B%221%22%2C%221%22%5D")
  })
 })