We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Haml contains a method to ensure that generated html is not escaped. Specifically, you can use != instead of = if you want to avoid escaping.
!=
=
https://haml.info/docs/yardoc/file.REFERENCE.html#unescaping_html
= "I feel <strong>!" != "I feel <strong>!"
However, like using raw and h() and .html_safe and friends, it's very easy to accidentally create security holes in your application
raw
h()
.html_safe
!= "Username: <strong>#{user.name}</strong>"
In most cases != is undesirable, and can be avoided by using safer methods (e.g. in Rails, by using SafeBuffers when building in views or helpers).
I'd therefore like to see a linter that can flag up uses of !=, in case they slip through code review.
The text was updated successfully, but these errors were encountered:
No branches or pull requests
Haml contains a method to ensure that generated html is not escaped. Specifically, you can use
!=
instead of=
if you want to avoid escaping.https://haml.info/docs/yardoc/file.REFERENCE.html#unescaping_html
However, like using
raw
andh()
and.html_safe
and friends, it's very easy to accidentally create security holes in your applicationIn most cases
!=
is undesirable, and can be avoided by using safer methods (e.g. in Rails, by using SafeBuffers when building in views or helpers).I'd therefore like to see a linter that can flag up uses of
!=
, in case they slip through code review.The text was updated successfully, but these errors were encountered: