diff --git a/packages/ssr/Cargo.toml b/packages/ssr/Cargo.toml index 0ce901b5a..02900ca0e 100644 --- a/packages/ssr/Cargo.toml +++ b/packages/ssr/Cargo.toml @@ -14,6 +14,7 @@ keywords = ["dom", "ui", "gui", "react", "ssr"] [dependencies] dioxus-core = { path = "../core", version = "^0.3.0", features = ["serialize"] } +askama_escape = "0.10.3" [dev-dependencies] dioxus = { path = "../dioxus", version = "0.3.0" } diff --git a/packages/ssr/src/cache.rs b/packages/ssr/src/cache.rs index 39bfb8671..8556682f1 100644 --- a/packages/ssr/src/cache.rs +++ b/packages/ssr/src/cache.rs @@ -82,7 +82,13 @@ impl StringCache { } cur_path.pop(); } - TemplateNode::Text { text } => write!(chain, "{text}")?, + TemplateNode::Text { text } => { + write!( + chain, + "{}", + askama_escape::escape(text, askama_escape::Html) + )?; + } TemplateNode::Dynamic { id: idx } | TemplateNode::DynamicText { id: idx } => { chain.segments.push(Segment::Node(*idx)) } diff --git a/packages/ssr/src/renderer.rs b/packages/ssr/src/renderer.rs index 8c828f01c..5496148c4 100644 --- a/packages/ssr/src/renderer.rs +++ b/packages/ssr/src/renderer.rs @@ -104,8 +104,11 @@ impl Renderer { write!(buf, "")?; } - // todo: escape the text - write!(buf, "{}", text.value)?; + write!( + buf, + "{}", + askama_escape::escape(text.value, askama_escape::Html) + )?; if self.pre_render { write!(buf, "")?; @@ -138,7 +141,7 @@ fn to_string_works() { fn app(cx: Scope) -> Element { let dynamic = 123; - let dyn2 = ""; // todo: escape this + let dyn2 = ""; // this should be escaped render! { div { class: "asdasdasd", class: "asdasdasd", id: "id-{dynamic}", @@ -165,10 +168,10 @@ fn to_string_works() { vec![ PreRendered("
Hello world 1 -->".into(),), + PreRendered(">Hello world 1 -->".into(),), Node(0,), PreRendered( - "<-- Hello world 2
nest 1
nest 2
".into(), + "<-- Hello world 2
nest 1
nest 2
".into(), ), Node(1,), Node(2,), @@ -180,5 +183,5 @@ fn to_string_works() { use Segment::*; - assert_eq!(out, "
Hello world 1 -->123<-- Hello world 2
nest 1
nest 2
finalize 0
finalize 1
finalize 2
finalize 3
finalize 4
"); + assert_eq!(out, "
Hello world 1 -->123<-- Hello world 2
nest 1
nest 2
</diiiiiiiiv>
finalize 0
finalize 1
finalize 2
finalize 3
finalize 4
"); } diff --git a/packages/ssr/tests/simple.rs b/packages/ssr/tests/simple.rs index 63137aeae..395f801e1 100644 --- a/packages/ssr/tests/simple.rs +++ b/packages/ssr/tests/simple.rs @@ -38,7 +38,7 @@ fn dynamic() { dioxus_ssr::render_lazy(rsx! { div { "Hello world 1 -->" "{dynamic}" "<-- Hello world 2" } }), - "
Hello world 1 -->123<-- Hello world 2
" + "
Hello world 1 -->123<-- Hello world 2
" ); }