Keats / tera

A template engine for Rust based on Jinja2/Django
http://keats.github.io/tera/
MIT License
3.43k stars 279 forks source link

UTF-8 encoding issues when parsing .html sources with functions #850

Closed leon-thomm closed 1 year ago

leon-thomm commented 1 year ago

I just started experimenting with tera, and I'm quite certain that this is a basic issue, but I couldn't find the answer in the guide and documentation. Consider the following code:

use std::collections::HashMap;
use tera;

fn main() {
    let mut tera = tera::Tera::default();
    tera.register_function("func", make_template_function());
    tera.add_raw_template("test.html", "{{ func() }}").unwrap();
    let output = tera.render("test.html", &tera::Context::new()).unwrap();
    println!("{}", output);
}

fn make_template_function() -> impl tera::Function {
    Box::new(move |args: &HashMap<String, tera::Value>| {
        tera::Result::Ok("a/b".into())
    })
}

Expected output: a/b.

Actual output: a&#x2F;b.

Notice &#x2F; is the unicode hex-char code for /. This does not happen when I remove the .html from test.html. Including <meta charset="utf-8"> in the parsed string doesn't help. Why is this happening?

leon-thomm commented 1 year ago

I am realizing (or rather someone on the Rust Discord pointed out that) this is the numeric character reference of "/" in unicode which yields totally valid HTML. What is the reason for using NCRs instead of the characters themselves if Rust strings are already UTF-8?

Keats commented 1 year ago

This is just escaping HTML characters. Use {{ func() | safe }} is the output is safe