Skip to content

Instantly share code, notes, and snippets.

@stevenhao
Last active June 27, 2017 00:21
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save stevenhao/40f852353089e3d27391266eea6b67ba to your computer and use it in GitHub Desktop.
Save stevenhao/40f852353089e3d27391266eea6b67ba to your computer and use it in GitHub Desktop.
Breaking Blaze HTML-escaping of <script> contents
diff --git a/packages/boilerplate-generator/boilerplate-generator.js b/packages/boilerplate-generator/boilerplate-generator.js
index 22e06e98f..9be1cc14c 100644
--- a/packages/boilerplate-generator/boilerplate-generator.js
+++ b/packages/boilerplate-generator/boilerplate-generator.js
@@ -88,6 +88,7 @@ Boilerplate.prototype._generateBoilerplateFromManifestAndSource =
readUtf8FileSync(pathMapper(item.path));
}
});
+ boilerplateBaseData.test = 'alert("Is one less that two? Click to find out!"); if (1 < 2) alert("YES!") else alert("NO!")';
var boilerplateRenderCode = SpacebarsCompiler.compile(
boilerplateSource, { isBody: true });
diff --git a/packages/boilerplate-generator/boilerplate_web.browser.html b/packages/boilerplate-generator/boilerplate_web.browser.html
index fb03a5702..0f9d9ba33 100644
--- a/packages/boilerplate-generator/boilerplate_web.browser.html
+++ b/packages/boilerplate-generator/boilerplate_web.browser.html
@@ -14,6 +14,9 @@
{{/if}}
{{#each js}} <script type="text/javascript" src="{{../bundledJsCssUrlRewriteHook url}}"></script>
{{/each}}
+<script>
+ {{test}}
+</script>
{{#each additionalStaticJs}}
{{#if ../inlineScriptsAllowed}}
<script type='text/javascript'>
@stevenhao
Copy link
Author

stevenhao commented Jun 26, 2017

The relevant html generated:

<script>
  alert("Is one less that two? Click to find out!"); if (1 &lt; 2) alert("YES!") else alert("NO!")
</script>

The resulting behavior (Chrome):

Uncaught SyntaxError: Unexpected token ;             (index):74 

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment