search

voltrb / volt

A Ruby web framework where your Ruby runs on both server and client
MIT License
3.22k stars 196 forks source link

Command to force bindings not to auto-escape everything #284

Open dany-on-demand opened 9 years ago

dany-on-demand commented 9 years ago

Bindings currently auto-escape code to make it formatted the same way it is in the input. You can use {{ raw attrs.XYZ }} in the binding if you want, though that opens you up to xss attacks.

In some cases it is useful not to use this behaviour, for example:

<:Body>
    <:item-description title="This&nbsp;is&nbsp;a&nbsp;title where the first few words are forced to always stay on the same paragraph and not be ugly.">Lorem ipsum dolor ist amet</:item-description>
<:Item_description>
    <h3> {{ attrs.title }} </h3>
    <p> {{ yield }} </p> {{ #text body }}
ryanstout commented 9 years ago

@dany-on-demand sorry, I'm not sure I follow here. Is it that you want something like raw that doesn't open you up to xss?