yeahjs
yeahjs copied to clipboard
Backticks and placeholders are not being escaped
Consider the following example:
import { compile } from "yeahjs";
const ejs = "const greeting = `Hello ${<%- JSON.stringify(locals.name) %>}!`;"
const template = compile(ejs);
const output = template({ name: "Alice" });
console.log(output);
Fails with:
'use strict'; let _out = `const greeting = `Hello ${` + _str(( JSON.stringify(locals.name)
^^^^^
SyntaxError: Unexpected identifier 'Hello'
at new Function (<anonymous>)
at compile (file:///home/user/yeahjs-demo/node_modules/yeahjs/index.js:30:16)
at file:///home/user/yeahjs-demo/index.js:4:18
at ModuleJob.run (node:internal/modules/esm/module_job:271:25)
at async onImport.tracePromise.__proto__ (node:internal/modules/esm/loader:578:26)
at async asyncRunEntryPointWithESMLoader (node:internal/modules/run_main:116:5)
Expected printed output:
const greeting = `Hello ${"Alice"}!`;
Importing ejs instead of yeahjs in the above example produces the expected output.
When generating the _out code string, both backticks ` and placeholder start sequences ${ must be escaped.