html escape <%= and don't escape <%-

elua.moon

@@ -14,11 +14,22 @@ setfenv = setfenv or (fn, env) ->
 
   fn
 
+html_escape_entities = {
+  ['&']: '&'
+  ['<']: '&lt;'
+  ['>']: '&gt;'
+  ['"']: '&quot;'
+  ["'"]: '&#039;'
+}
+
+html_escape = (str) ->
+  (str\gsub [=[["><'&]]=], html_escape_entities)
 
 class Parser
   open_tag: "<%"
   close_tag: "%>"
   modifiers: "^[=-]"
+  html_escape: true
 
   next_tag: =>
     start, stop = @str\find @open_tag, @pos, true
@@ -47,8 +58,7 @@ class Parser
       close_start -= 1
       true
 
-    kind = modifier == "=" and "interplate" or "code"
+    @push_code modifier or "code", @pos, close_start - 1
-    @push_code kind, @pos, close_start - 1
 
     @pos = close_stop + 1
 
@@ -120,16 +130,16 @@ class Parser
     code_fn = coroutine.wrap ->
       coroutine.yield code
 
-    fn = load code_fn, name
+    fn = assert load(code_fn, name)
     (env={}) ->
       setfenv fn, env
-      fn tostring, concat
+      fn tostring, concat, html_escape
 
   -- generates the code of the template
   chunks_to_lua: =>
     -- todo: find a no-conflict name for buffer
     buffer = {
-      "local _b, _b_i, _tostring, _concat = {}, 0, ..."
+      "local _b, _b_i, _tostring, _concat, _escape = {}, 0, ..."
     }
     buffer_i = #buffer
 
@@ -146,8 +156,13 @@ class Parser
           push "_b[_b_i] = #{("%q")\format(chunk)}"
         when "code"
           push chunk[2]
-        when "interplate"
+        when "=", "-"
-          assign = "_b[_b_i] = _tostring(#{chunk[2]})"
+          assign = "_tostring(#{chunk[2]})"
+
+          if t == "=" and @html_escape
+            assign = "_escape(" .. assign .. ")"
+
+          assign = "_b[_b_i] = " .. assign
 
           -- validate syntax
           unless loadstring assign

spec/elua_spec.moon

@@ -22,10 +22,14 @@ describe "elua", ->
       }
 
       {
-        "y%>u"
+        "y%>u"
         [[<%= "y%>u" %>]]
       }
 
+      {
+        "y%>u"
+        [[<%- "y%>u" %>]]
+      }
 
       {
         [[
@@ -35,29 +39,19 @@ This is my message to 4
 
 
   hello 1
-
   hello 2
-
   hello 3
-
   hello 4
-
   hello 5
-
   hello 6
-
   hello 7
-
   hello 8
-
   hello 9
-
   hello 10
 
-
 message: yeah
 
-This is my message to oh yeah  %>"]]
+This is my message to oh yeah  %&gt;&quot;]]
         [[
 This is my message to <%= "you" %>
 This is my message to <%= 4 %>
@@ -66,7 +60,7 @@ This is my message to <%= 4 %>
 <% end %>
 
 <% for i=1,10 do%>
-  hello <%= i %>
+  hello <%= i -%>
 <% end %>
 
 message: <%= visitor %>