nex3/haml — Issue #495: Backslash in string not escaped
Author: tcwitte
Created: 2012-03-06 14:43:40+00:00
State: open

Escape sequences that occur in strings are not escaped when :escape_html is set to true.

For example:
template = "---\n%html(xml:lang='en' lang='en')\n %body\n = 'Hello \0 World'"
engine = Haml::Engine.new(template, {:escape_html => true})
engine.to_html
yields
"\n

\n Hello \000 World\n

\n\n"

The raw \000 causes problems with programs that consume the HTML (e.g. only the part of the page until the character is shown). I would expect the backslash to be replaced with the corresponding HTML entity \ (ampersand hash 9 2 semicolon).

The above was verified with version 3.1.4.