feat: automatic output escaping, closes #500

This commit is contained in:
Harttle
2022-04-22 02:19:36 +08:00
parent e69a51025e
commit f88490cd3c
9 changed files with 188 additions and 7 deletions
+1
View File
@@ -51,6 +51,7 @@ filters:
newline_to_br: newline_to_br.html
plus: plus.html
prepend: prepend.html
raw: raw.html
remove: remove.html
remove_first: remove_first.html
replace: replace.html
+1 -1
View File
@@ -14,6 +14,6 @@ String | append, prepend, capitalize, upcase, downcase, strip, lstrip, rstrip, s
HTML/URI | escape, escape_once, url_encode, url_decode, strip_html, newline_to_br
Array | slice, map, sort, sort_natural, uniq, where, first, last, join, reverse, concat, compact, size
Date | date
Misc | default, json
Misc | default, json, raw
[shopify/liquid]: https://github.com/Shopify/liquid
+51
View File
@@ -0,0 +1,51 @@
---
title: raw
---
{% since %}v9.37.0{% endsince %}
Liquid filter that directly returns the value of the variable. Useful when [outputEscape](/api/interfaces/liquid_options_.liquidoptions.html#Optional-outputEscape) is set.
{% note info Auto escape %}
By default `outputEscape` is not set. That means LiquidJS output is not escaped by default, thus `raw` filter is not useful until `outputEscape` is set.
{% endnote %}
Input (`outputEscape` not set)
```liquid
{{ "<" }}
```
Output
```text
<
```
Input (`outputEscape="escape"`)
```liquid
{{ "<" }}
```
Output
```text
&lt;
```
Input (`outputEscape="json"`)
```liquid
{{ "<" }}
```
Output
```text
"<"
```
Input (`outputEscape="escape"`)
```liquid
{{ "<" | raw }}
```
Output
```text
<
```
+52
View File
@@ -0,0 +1,52 @@
---
title: raw
---
{% since %}v9.37.0{% endsince %}
直接返回变量的值。配合 [outputEscape](/api/interfaces/liquid_options_.liquidoptions.html#Optional-outputEscape) 参数使用。
{% note info 自动转义 %}
默认情况下 `outputEscape``undefined`,这意味着 LiquidJS 输出不会默认转义,因此这时使用 `raw` 没有意义。
{% endnote %}
输入(未设置 `outputEscape`
```liquid
{{ "<" }}
```
输出
```text
<
```
输入(`outputEscape="escape"`
```liquid
{{ "<" }}
```
输出
```text
&lt;
```
输入(`outputEscape="json"`
```liquid
{{ "<" }}
```
输出
```text
"<"
```
输入(`outputEscape="escape"`
```liquid
{{ "<" | raw }}
```
输出
```text
<
```