yeahjs icon indicating copy to clipboard operation
yeahjs copied to clipboard

Backticks and placeholders are not being escaped

Open YarnSphere opened this issue 9 months ago • 0 comments

Consider the following example:

import { compile } from "yeahjs";

const ejs = "const greeting = `Hello ${<%- JSON.stringify(locals.name) %>}!`;"
const template = compile(ejs);
const output = template({ name: "Alice" });

console.log(output);

Fails with:

'use strict'; let _out = `const greeting = `Hello ${` + _str(( JSON.stringify(locals.name) 
                                            ^^^^^

SyntaxError: Unexpected identifier 'Hello'
    at new Function (<anonymous>)
    at compile (file:///home/user/yeahjs-demo/node_modules/yeahjs/index.js:30:16)
    at file:///home/user/yeahjs-demo/index.js:4:18
    at ModuleJob.run (node:internal/modules/esm/module_job:271:25)
    at async onImport.tracePromise.__proto__ (node:internal/modules/esm/loader:578:26)
    at async asyncRunEntryPointWithESMLoader (node:internal/modules/run_main:116:5)

Expected printed output:

const greeting = `Hello ${"Alice"}!`;

Importing ejs instead of yeahjs in the above example produces the expected output.

When generating the _out code string, both backticks ` and placeholder start sequences ${ must be escaped.

YarnSphere avatar Mar 12 '25 15:03 YarnSphere