Skip to content

Commit 410141c

Browse files
committed
Fix escaping of non-javascript identifiers
The ‘ character would cause invalid javascript to be generated as it was not properly escaped. Switching to JSON.stringify safely handles all potential unescaped cases.
1 parent 060c087 commit 410141c

File tree

2 files changed

+7
-3
lines changed

2 files changed

+7
-3
lines changed

Diff for: lib/handlebars/compiler/javascript-compiler.js

+1-1
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ JavaScriptCompiler.prototype = {
1616
if (JavaScriptCompiler.isValidJavaScriptVariableName(name)) {
1717
return [parent, '.', name];
1818
} else {
19-
return [parent, "['", name, "']"];
19+
return [parent, '[', JSON.stringify(name), ']'];
2020
}
2121
},
2222
depthedLookup: function(name) {

Diff for: spec/basic.js

+6-2
Original file line numberDiff line numberDiff line change
@@ -207,8 +207,12 @@ describe('basic context', function() {
207207
});
208208

209209
it('literal references', function() {
210-
shouldCompileTo('Goodbye {{[foo bar]}} world!', {'foo bar': 'beautiful'},
211-
'Goodbye beautiful world!', 'Literal paths can be used');
210+
shouldCompileTo('Goodbye {{[foo bar]}} world!', {'foo bar': 'beautiful'}, 'Goodbye beautiful world!');
211+
shouldCompileTo('Goodbye {{"foo bar"}} world!', {'foo bar': 'beautiful'}, 'Goodbye beautiful world!');
212+
shouldCompileTo("Goodbye {{'foo bar'}} world!", {'foo bar': 'beautiful'}, 'Goodbye beautiful world!');
213+
shouldCompileTo('Goodbye {{"foo[bar"}} world!', {'foo[bar': 'beautiful'}, 'Goodbye beautiful world!');
214+
shouldCompileTo('Goodbye {{"foo\'bar"}} world!', {"foo'bar": 'beautiful'}, 'Goodbye beautiful world!');
215+
shouldCompileTo("Goodbye {{'foo\"bar'}} world!", {'foo"bar': 'beautiful'}, 'Goodbye beautiful world!');
212216
});
213217

214218
it("that current context path ({{.}}) doesn't hit helpers", function() {

0 commit comments

Comments
 (0)