diff --git a/lib/ejs.rb b/lib/ejs.rb index 686649a..77c75e9 100644 --- a/lib/ejs.rb +++ b/lib/ejs.rb @@ -69,7 +69,7 @@ def js_unescape!(source) def replace_escape_tags!(source, options) source.gsub!(options[:escape_pattern] || escape_pattern) do - "',(''+#{js_unescape!($1)})#{escape_function},'" + "',(''+(#{js_unescape!($1)}))#{escape_function},'" end end diff --git a/test/test_ejs.rb b/test/test_ejs.rb index ed760da..88b5f9f 100644 --- a/test/test_ejs.rb +++ b/test/test_ejs.rb @@ -170,6 +170,32 @@ class EJSEvaluationTest < Test::Unit::TestCase assert_equal "'Foo Bar'", EJS.evaluate(template, { :foobar => "'Foo Bar'" }) end + test "escaping with conditions" do + params = { :foobar => "Foo Bar" } + safe_string = "<b>Foo Bar</b>" + + template = "<%- true || foobar %>" + assert_equal "true", EJS.evaluate(template, params) + + template = "<%- null || foobar %>" + assert_equal safe_string, EJS.evaluate(template, params) + + template = "<%- false || foobar %>" + assert_equal safe_string, EJS.evaluate(template, params) + + template = "<%- foobar || 'Foo & Bar' %>" + assert_equal safe_string, EJS.evaluate(template, params) + + template = "<%- true ? foobar : 'foobar' %>" + assert_equal safe_string, EJS.evaluate(template, params) + + template = "<%- false ? foobar : 'Foo & Bar' %>" + assert_equal "Foo & Bar", EJS.evaluate(template, params) + + template = "<%- true ? (false || 'Foo & Bar') : 'Foo' %>" + assert_equal "Foo & Bar", EJS.evaluate(template, params) + end + test "braced escaping" do template = "{{- foobar }}" assert_equal "<b>Foo Bar</b>", EJS.evaluate(template, { :foobar => "Foo Bar" }, BRACE_SYNTAX)