whoward / cadenza

parser and renderer library for liquid-like templates
13 stars 6 forks source link

XSS Protection #31

Open whoward opened 9 years ago

whoward commented 9 years ago

Allow escaping the html output of inject tags (unless it is marked as a safe string)

The way to do this is to change the buffer object in the renderer from a plain old io object to a buffer interface like ActiveSupport::SafeBuffer. In rails we will automatically configure Cadenza to use AS::SB