leafo / lapis

A web framework for Lua and OpenResty written in MoonScript
http://leafo.net/lapis/
MIT License
3.14k stars 247 forks source link

HTML entities inside strings are left out raw #703

Closed ghoomfrog closed 4 years ago

ghoomfrog commented 4 years ago

E.g. p '&bull;' => <p>&bull;</p>.

leafo commented 4 years ago

All html is escaped by default to prevent XSS injection.

If you want to render unescapted html use the raw function: (note, raw writes to the buffer, it does not return anything, so we call it in a function to render to the buffer when inside of the p tag)

p -> raw "&bull;"

I recommend never using raw because it can be a source of security vulnerabilities. You can put the actual bullet character directly into your view like this:

p "•"