diff --git a/lib/haml.rb b/lib/haml.rb index 779bf7d0..aa600c7e 100644 --- a/lib/haml.rb +++ b/lib/haml.rb @@ -252,7 +252,7 @@ $LOAD_PATH << dir unless $LOAD_PATH.include?(dir) # For example: # # %br/ -# %meta{'http-equiv' => 'Content-Type', :content => 'text/html'}/ +# %meta{'http-euiv' => 'Content-Type', :content => 'text/html'}/ # # is compiled to: # @@ -633,6 +633,15 @@ $LOAD_PATH << dir unless $LOAD_PATH.include?(dir) # yo #
# +# If the :escape_html option is set, +# = will sanitize any HTML-sensitive characters generated by the script. +# For example: +# +# = '' +# +# would be compiled to +# +# <script>alert("I'm evil!");</script> # # ==== - # @@ -685,6 +694,40 @@ $LOAD_PATH << dir unless $LOAD_PATH.include?(dir) # \\ Look at \yon lack of backslash: #{foo} # # +# ==== &= +# +# An ampersand followed by an equals character +# evaluates Ruby code just like the single equals, +# but sanitizes any HTML-sensitive characters in the result of the code. +# For example: +# +# &= "I like cheese & crackers" +# +# compiles to +# +# I like cheese & crackers +# +# If the :escape_html option is set, +# &= behaves identically to =. +# +# ==== != +# +# An exclamation mark followed by an equals character +# evaluates Ruby code just like the single equals, +# but never sanitizes the HTML. +# +# By default, the single equals doesn't sanitize HTML either. +# However, if the :escape_html option is set, = will sanitize the HTML, but != still won't. +# For example, if :escape_html is set: +# +# = "I feel !" +# != "I feel !" +# +# compiles to +# +# I feel <strong>! +# I feel ! +# # ===== Blocks # # Ruby blocks, like XHTML tags, don't need to be explicitly closed in Haml. @@ -789,6 +832,12 @@ $LOAD_PATH << dir unless $LOAD_PATH.include?(dir) # identical to :xhtml except there are no self-closing tags, # XML prolog is ignored and correct DOCTYPEs are generated. # +# [:escape_html] Sets whether or not to escape HTML-sensitive characters in script. +# If this is true, = behaves like &=; +# otherwise, it behaves like !=. +# Note that this doesn't affect attributes or == interpolation. +# Defaults to false. +# # [:suppress_eval] Whether or not attribute hashes and Ruby scripts # designated by = or ~ should be # evaluated. If this is true, said scripts are