Text inside of tags is HTML escaped.

2026-02-09 06:05:11 -05:00 · 2012-01-19 16:36:32 -08:00
parent ba2ed50e87
commit 660beb9f65
2 changed files with 11 additions and 1 deletions
--- a/src/stdlib/template/text.coffee
+++ b/src/stdlib/template/text.coffee
@@ -2,5 +2,11 @@ module.exports =
 class Text
  constructor: (@string) ->

-  toHtml: -> @string
+  toHtml: ->
+    @string
+      .replace(/&/g, '&amp;')
+      .replace(/"/g, '&quot;')
+      .replace(/'/g, '&#39;')
+      .replace(/</g, '&lt;')
+      .replace(/>/g, '&gt;')