diff --git a/CHANGELOG.md b/CHANGELOG.md index f7c62853..b94e88b9 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,7 +5,7 @@ Changelog 2.4.3 (Sep 7 2016) ---------------- -* Fix potential cast-related XSS vulnerability in autoescape mode. +* Fix potential cast-related XSS vulnerability in autoescape mode, and with `escape` filter. [#836](https://github.com/mozilla/nunjucks/pull/836) 2.4.2 (Apr 15 2016) diff --git a/src/filters.js b/src/filters.js index db1057f9..82fea7bb 100644 --- a/src/filters.js +++ b/src/filters.js @@ -116,10 +116,10 @@ var filters = { }, escape: function(str) { - if(typeof str === 'string') { - return r.markSafe(lib.escape(str)); + if(str instanceof r.SafeString) { + return str; } - return str; + return r.markSafe(lib.escape(str.toString())); }, safe: function(str) { diff --git a/tests/filters.js b/tests/filters.js index 8fd23eec..03369a62 100644 --- a/tests/filters.js +++ b/tests/filters.js @@ -110,6 +110,15 @@ finish(done); }); + it('should work with non-string values', function(done) { + var res1 = render('{{ foo | escape }}', {foo: ['']}, { autoescape: false }); + expect(res1).to.be('<html>'); + + var res2 = render('{{ foo | escape }}', {foo: {toString: function() { return ''; }}}, { autoescape: false }); + expect(res2).to.be('<html>'); + finish(done); + }); + it('should not escape safe strings with autoescape on', function(done) { var res1 = render('{{ "" | safe | escape }}', {}, { autoescape: true }); expect(res1).to.be('');