gtzilla / fastFrag

A purely client-side JavaScript template powered by JSON and returning valid Document Fragments for DOM insertion
http://json.fastfrag.org/
The Unlicense
92 stars 21 forks source link

Parsing '<' and '>' #9

Open josher19 opened 12 years ago

josher19 commented 12 years ago

fastFrag HTML => JSON Converter

Fails to convert from HTML to JSON fully when it encounters a '<' on json.fastfrag.org :

<div>
              <h5>LiveScript</h5>
<pre class="prettyprint lang-ls">
filter (< 3), [1 to 5] #=> [1, 2]
filter even, {a: 3, b: 4, c: 0} #=> {b: 4, c: 0}
filter (== \a), 'hahaha' #=> 'aaa'
</pre>
            </div>
            <div class="example-js">
              <h5>JavaScript</h5>
<pre class="prettyprint lang-js">
filter(odd, [1, 2, 3, 4, 5]); //=> [1, 3, 5]
filter(function(x){ return x <= 2; }, 
  {x: 4, y: 2, z: 8}); //=> {y: 2}
</pre>
</div>

The results get truncated at "<":

[
    {
        "content": [
            {
                "content": {
                    "text": "LiveScript"
                }, 
                "type": "h5"
            }, 
            {
                "content": [
                    {
                        "text": "\r\nfilter ("
                    }, 
                    {
                        "text": "<" // truncated!
                    }
                ], 
                "css": "prettyprint lang-ls", 
                "type": "pre"
            }
        ]
    }, 
    {
        "content": [
            {
                "content": {
                    "text": "JavaScript"
                }, 
                "type": "h5"
            }, 
            {
                "content": [
                    {
                        "text": "\r\nfilter(odd, [1, 2, 3, 4, 5]); //=> [1, 3, 5]\r\nfilter(function(x){ return x "
                    }, 
                    {
                        "text": "<" // // truncated!
                    }
                ], 
                "css": "prettyprint lang-js", 
                "type": "pre"
            }
        ], 
        "css": "example-js"
    }
]

Replacing < with &lt; or \u003c in HTML does not work as expected.

Is this a "security feature" or a bug?

josher19 commented 12 years ago

PS: This looks like a problem with testFrag-util rather than testFrag itself.

fastFrag.create({"content":" (<3) Less Than Works!","type":"div"})