feat: automatic output escaping, closes #500

2026-09-16 12:50:38 -07:00 · 2022-04-22 02:19:36 +08:00
parent e69a51025e
commit f88490cd3c
9 changed files with 188 additions and 7 deletions
@@ -0,0 +1,42 @@
+import { expect } from 'chai'
+import { Liquid } from '../../../src/liquid'
+
+describe('LiquidOptions#*outputEscape*', function () {
+  it('when outputEscape is not set', async function () {
+    const engine = new Liquid()
+    const html = await engine.parseAndRender('{{"<"}}')
+    expect(html).to.equal('<')
+  })
+
+  it('should escape when outputEscape="escape"', async function () {
+    const engine = new Liquid({
+      outputEscape: 'escape'
+    })
+    const html = await engine.parseAndRender('{{"<"}}')
+    expect(html).to.equal('&lt;')
+  })
+
+  it('should json stringify when outputEscape="json"', async function () {
+    const engine = new Liquid({
+      outputEscape: 'json'
+    })
+    const html = await engine.parseAndRender('{{"<"}}')
+    expect(html).to.equal('"<"')
+  })
+
+  it('should support outputEscape=Function', async function () {
+    const engine = new Liquid({
+      outputEscape: (v: any) => `{${v}}`
+    })
+    const html = await engine.parseAndRender('{{"<"}}')
+    expect(html).to.equal('{<}')
+  })
+
+  it('should skip escape for output with filter "| raw"', async function () {
+    const engine = new Liquid({
+      outputEscape: 'escape'
+    })
+    const html = await engine.parseAndRender('{{"<" | raw}}')
+    expect(html).to.equal('<')
+  })
+})