Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

filter indent escapes HTML to < and > #332

Open
jameskr97 opened this issue Aug 18, 2023 · 1 comment
Open

filter indent escapes HTML to < and > #332

jameskr97 opened this issue Aug 18, 2023 · 1 comment
Labels
enhancement New feature or request

Comments

@jameskr97
Copy link

jameskr97 commented Aug 18, 2023

Description

When I put HTML inside an indent filter, the HTML is escaped and becomes <, >, ", etc.

Reproduction steps

Here is a sample code that shows the issue.

use minijinja::{Environment};

#[tokio::main]
async fn main() {
    let mut env = Environment::new();
    env.add_template("example.html","
<p>this is outside the filter</p>
{%- filter indent(4) %}
   <p>this is inside</p>
{%- endfilter -%}
    ").unwrap();

    let example = env.get_template("example.html").unwrap();
    println!("{}", example.render(()).unwrap());
}

Here is the output I get from cargo run

Finished dev [unoptimized + debuginfo] target(s) in 0.17s
 Running `target\debug\test_app.exe`

<p>this is outside the filter</p>
       &lt;p&gt;this is inside&lt;&#x2f;p&gt;

Additional helpful information:

I only noticed this issue when the file ended in .html. When I tried to add the extension .jinja or .j2 this issue did not occur. I originally saw this happening when I had a base.html and index.html which extended from the base, where everything inside the {% block content %} rendered with escaped HTML. I simplified it down to the example shown above.

  • Version of minijinja: 1.0.6
  • Version of rustc: 1.71.1
  • Operating system and version: Windows 11 Pro 22H2

What did you expect

As a practice project, I'm rewriting one of my python flask apps to have a Rust backend. I expected the HTML to render as HTML without the &lt;, &gt;, similar to how it worked when I used Python.

@mitsuhiko
Copy link
Owner

The string filters currently are not escaping aware. For now you need to explicitly mark them as safe:

{%- filter indent(4)|safe %}
   <p>this is inside</p>
{%- endfilter -%}

@mitsuhiko mitsuhiko added the enhancement New feature or request label Aug 22, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

2 participants