Merge pull request #25 from vapor/html-escape

add html escaping to string variables

Sources/Leaf/HTMLEscape.swift

@@ -0,0 +1,11 @@
+import Foundation
+
+extension String {
+    func htmlEscaped() -> String {
+        return replacingOccurrences(of: "&", with: "&")
+            .replacingOccurrences(of: "\"", with: """)
+            .replacingOccurrences(of: "'", with: "'")
+            .replacingOccurrences(of: "<", with: "&lt;")
+            .replacingOccurrences(of: ">", with: "&gt;")
+    }
+}

Sources/Leaf/Node+Rendered.swift

@@ -8,7 +8,8 @@ extension Node {
         case let .number(number):
             return number.description.bytes
         case let .string(str):
-            return str.bytes
+            // defaults to escaping, use #raw(var) to unescape. 
+            return str.htmlEscaped().bytes
         case let .bytes(bytes):
             return bytes
         }

Sources/Leaf/Tag/Models/Raw.swift

@@ -1,4 +1,4 @@
-class Raw: Tag {
+final class Raw: Tag {
     let name = "raw"
 
     func compileBody(stem: Stem, raw: String) throws -> Leaf {
@@ -7,8 +7,11 @@ class Raw: Tag {
     }
 
     func run(stem: Stem, context: Context, tagTemplate: TagTemplate, arguments: [Argument]) throws -> Node? {
-        return nil
+        guard let string = arguments.first?.value?.string else { return nil }
+        let unescaped = string.bytes
+        return .bytes(unescaped)
     }
+
     func shouldRender(stem: Stem, context: Context, tagTemplate: TagTemplate, arguments: [Argument], value: Node?) -> Bool {
         return true
     }

Tests/LeafTests/RawTests.swift

@@ -13,4 +13,12 @@ class RawTests: XCTestCase {
         let expectation = "Everything stays ##@$&"
         XCTAssertEqual(rendered, expectation)
     }
+
+    func testRawVariable() throws {
+        let raw = try stem.spawnLeaf(raw: "Hello, #raw(unescaped)!")
+        let context = Context(["unescaped": "<b>World</b>"])
+        let rendered = try stem.render(raw, with: context).string
+        let expectation = "Hello, <b>World</b>!"
+        XCTAssertEqual(rendered, expectation)
+    }
 }