Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

amp-bind: Support special chars in strings #23811

Merged
merged 8 commits into from
Aug 9, 2019

Conversation

dreamofabear
Copy link

Fixes #17863 and fixes #22265.

@dreamofabear
Copy link
Author

/to @jridgewell

@@ -205,6 +205,17 @@ describe('BindExpression', () => {
expect(evaluate('+"1"')).to.equal(1);
});

it('should parse special characters', () => {
expect(evaluate('"\\n"')).to.equal('\n');
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What does this look like when written in HTML?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks like "\n".

const string = yytext.substr(1, yyleng - 2);
// Replace leading/trailing single-quote with double-quote chars and
// use JSON.parse() to process special chars e.g. '\n'.
const string = parseJson(`"${yytext.substr(1, yyleng - 2)}"`);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this safe? What if we used a single quote and the string includes double quotes inside it?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Attribute values can't have double quotes.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note, this will also transform unicode escapes (\u0000) into their unicode chars.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yea, that's #22265.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

<div attr='foo"bar'> is legal HTML

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Excellent catch. 👍

const string = yytext.substr(1, yyleng - 2);
// Replace leading/trailing single-quote with double-quote chars and
// use JSON.parse() to process special chars e.g. '\n'.
const string = parseJson(`"${yytext.substr(1, yyleng - 2)}"`);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note, this will also transform unicode escapes (\u0000) into their unicode chars.

const string = yytext.substr(1, yyleng - 2);
// Replace leading/trailing single-quote with double-quote chars and
// use JSON.parse() to process special chars e.g. '\n'.
const string = parseJson(`"${yytext.substr(1, yyleng - 2)}"`);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

<div attr='foo"bar'> is legal HTML

@dreamofabear dreamofabear merged commit ca56b39 into ampproject:master Aug 9, 2019
@dreamofabear dreamofabear deleted the bind-special-chars branch August 9, 2019 17:41
thekorn pushed a commit to edelight/amphtml that referenced this pull request Sep 11, 2019
* Support special chars.

* Fix single quote strings.

* Fix presubmit, add test.

* Add test for escaping special chars.

* Escape double-quotes in strings and fallback to non-parsed string.

* Use regex with /g.

* One more test case.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[amp-bind] Escaped characters in amp-state strings fail to be decoded amp-bind escapes new lines in strings
3 participants