haml6 & string interpolation escapes

[jdelStrother]

Thanks for haml6! But I'm puzzled by a change we're seeing with it in our Rails 7.0.3 app. A template like this:

%div
  %p= link_to "link1", "/"
  %p click #{link_to "link2", "/"}

Generates this html in haml 5.2.2:

<div>
<p><a href="/">link1</a></p>
<p>click <a href="/">link2</a></p>
</div>

But generates this html in haml 6.0.0:

<div>
<p><a href="/">link1</a></p>
<p>click &lt;a href=&quot;/&quot;&gt;link2&lt;/a&gt;</p>
</div>

Should we still be able to use foo #{html_safe_string} bar without html_safe_string getting over-escaped?

[jdelStrother]

Possibly in haml/util.rb it should be something like this?

    def unescape_interpolation(str, escape_html = nil)
      res = ''.dup
      rest = Haml::Util.handle_interpolation str.dump do |scan|
        escapes = (scan[2].size - 1) / 2
        char = scan[3] # '{', '@' or '$'
        res << scan.matched[0...-3 - escapes]
        if escapes % 2 == 1
          res << "\##{char}"
        else
          interpolated = if char == '{'
            balance(scan, ?{, ?}, 1)[0][0...-1]
          else
            scan.scan(/\w+/)
          end
          content = eval("\"#{interpolated}\"")
          content = "#{char}#{content}" if char == '@' || char == '$'
-          content = "CGI.escapeHTML((#{content}).to_s)" if escape_html
+          content = "Haml::Util.escape_html_safe((#{content}).to_s)" if escape_html

          res << "\#{#{content}}"
        end
      end
      res + rest
    end

[k0kubun]

I'll need more time to work on a better solution, but I accepted your patch for now. Thank you!

[k0kubun]

Released as v6.0.1.