Repository: mozilla/nunjucks
Pull request #1437 (2023-04-12 14:16:52)

fix: html encode backslashes if used with escape filter or autoescape
Backslashes should be html encoded when present in expressions that are passed to the escape filter (including when this happens automatically with autoescape)

codecov[bot]: ## [Codecov](https://codecov.io/gh/mozilla/nunjucks/pull/1437?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=mozilla) Report
Patch coverage: **`100.00`**% and no project coverage change.
> Comparison is base [(`fd50090`)](https://codecov.io/gh/mozilla/nunjucks/commit/fd500902d7c88672470c87170796de52fc0f791a?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=mozilla) 89.65% compared to head [(`833797a`)](https://codecov.io/gh/mozilla/nunjucks/pull/1437?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=mozilla) 89.65%.

> :exclamation: Current head 833797a differs from pull request most recent head 5ea30b5. Consider uploading reports for the commit 5ea30b5 to get more accurate results

<details><summary>Additional details and impacted files</summary>


```diff
@@           Coverage Diff           @@
##           master    #1437   +/-   ##
=======================================
  Coverage   89.65%   89.65%           
=======================================
  Files          22       22           
  Lines        3046     3046           
=======================================
  Hits         2731     2731           
  Misses        315      315           
```


| [Impacted Files](https://codecov.io/gh/mozilla/nunjucks/pull/1437?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=mozilla) | Coverage Δ | |
|---|---|---|
| [nunjucks/src/lib.js](https://codecov.io/gh/mozilla/nunjucks/pull/1437?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=mozilla#diff-bnVuanVja3Mvc3JjL2xpYi5qcw==) | `86.54% <100.00%> (ø)` | |

Help us with your feedback. Take ten seconds to tell us [how you rate us](https://about.codecov.io/nps?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=mozilla). Have a feature suggestion? [Share it here.](https://app.codecov.io/gh/feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=mozilla)

</details>

[:umbrella: View full report in Codecov by Sentry](https://codecov.io/gh/mozilla/nunjucks/pull/1437?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=mozilla).   
:loudspeaker: Do you have feedback about the report comment? [Let us know in this issue](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=mozilla).


Patch:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6bc4b1f..14f9299 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,13 @@
 Changelog
 =========
 
+3.2.4 (unreleased)
+------------------
+
+* HTML encode backslashes when expressions are passed through the escape
+  filter (including when this is done automatically with autoescape). Merge
+  of [#1427](https://github.com/mozilla/nunjucks/pull/1427).
+
 3.2.3 (Feb 15 2021)
 -------------------
 
diff --git a/nunjucks/src/lib.js b/nunjucks/src/lib.js
index 376db95..e99589f 100644
--- a/nunjucks/src/lib.js
+++ b/nunjucks/src/lib.js
@@ -8,10 +8,11 @@ var escapeMap = {
   '"': '&quot;',
   '\'': '&#39;',
   '<': '&lt;',
-  '>': '&gt;'
+  '>': '&gt;',
+  '\\': '&#92;',
 };
 
-var escapeRegex = /[&"'<>]/g;
+var escapeRegex = /[&"'<>\\]/g;
 
 var exports = module.exports = {};
 


Test patch:
diff --git a/tests/compiler.js b/tests/compiler.js
index 8e133e7..62f0aa9 100644
--- a/tests/compiler.js
+++ b/tests/compiler.js
@@ -1976,6 +1976,16 @@
       finish(done);
     });
 
+    it('should autoescape backslashes', function(done) {
+      equal(
+        '{{ foo }}',
+        { foo: 'foo \\\' bar' },
+        { autoescape: true },
+        'foo &#92;&#39; bar');
+
+      finish(done);
+    });
+
     it('should not autoescape when extension set false', function(done) {
       function TestExtension() {
         // jshint validthis: true
@@ -2031,7 +2041,7 @@
     });
 
     it('should render regexs', function(done) {
-      equal('{{ r/name [0-9] \\// }}',
+      equal('{{ r/name [0-9] \\// }}', {}, { autoescape: false },
         '/name [0-9] \\//');
 
       equal('{{ r/x/gi }}',
diff --git a/tests/filters.js b/tests/filters.js
index 6a975a1..554c10d 100644
--- a/tests/filters.js
+++ b/tests/filters.js
@@ -108,9 +108,9 @@
 
     it('escape', function() {
       equal(
-        '{{ "<html>" | escape }}', {},
+        '{{ "<html>\\\\" | escape }}', {},
         { autoescape: false },
-        '&lt;html&gt;');
+        '&lt;html&gt;&#92;');
     });
 
     it('escape skip safe', function() {