| Commit message (Collapse) | Author | Files | Lines | ||
|---|---|---|---|---|---|
| 2022-02-16 | Make json filter safe |  René Kijewski | 1 | -0/+3 | |
| Previously the built-in json filter had an issue that made it unsafe to use in HTML data. When used in HTML attributes an attacker who is able to supply an arbitrary string that should be JSON encoded could close the containing HTML element e.g. with `"</div>"`, and write arbitrary HTML code afterwards as long as they use apostrophes instead of quotation marks. The programmer could make this use case safe by explicitly escaping the JSON result: `{{data|json|escape}}`. In a `<script>` context the json filter was not usable at all, because in scripts HTML escaped entities are not parsed outside of XHTML documents. Without using the safe filter an attacker could close the current script using `"</script>"`. This PR fixes the problem by always escaping less-than, greater-than, ampersand, and apostrophe characters using their JSON unicode escape sequence `\u00xx`. Unless the programmer explicitly uses the safe filter, quotation marks are HTML encoded as `"`. In scripts the programmer should use the safe filter, otherwise not. | |||||
| 2021-11-24 | Remove authors from Cargo metadata (see RFC 3052) |  Dirkjan Ochtman | 1 | -1/+0 | |
| 2021-08-21 | Bump version numbers in anticipation of beta release | Dirkjan Ochtman | 1 | -1/+1 | |
| 2020-06-30 | Add askama_escape README to crate metadata | Dirkjan Ochtman | 1 | -1/+2 | |
| 2020-06-30 | Bump version numbers | Dirkjan Ochtman | 1 | -1/+1 | |
| 2020-01-15 | Remove obsolete CI badges | Dirkjan Ochtman | 1 | -2/+0 | |
| 2020-01-15 | Bump version numbers to 0.9.0 | Dirkjan Ochtman | 1 | -1/+1 | |
| 2019-08-26 | Update criterion requirement from 0.2 to 0.3 |  dependabot-preview[bot] | 1 | -1/+1 | |
| Updates the requirements on [criterion](https://github.com/bheisler/criterion.rs) to permit the latest version. - [Release notes](https://github.com/bheisler/criterion.rs/releases) - [Changelog](https://github.com/bheisler/criterion.rs/blob/master/CHANGELOG.md) - [Commits](https://github.com/bheisler/criterion.rs/compare/0.2.0...0.3.0) Signed-off-by: dependabot-preview[bot] <support@dependabot.com> | |||||
| 2019-01-17 | Bump versions in anticipation of 0.8.0 release | Dirkjan Ochtman | 1 | -1/+1 | |
| 2018-12-08 | Upgrade to 2018 edition | Dirkjan Ochtman | 1 | -0/+1 | |
| 2018-11-14 | Move escaping benchmarks into askama_escape crate | Dirkjan Ochtman | 1 | -0/+7 | |
| 2018-11-07 | Tweak metadata for new askama_escape crate | Dirkjan Ochtman | 1 | -2/+9 | |
| 2018-11-07 | Clean up unused features | Dirkjan Ochtman | 1 | -7/+0 | |
| 2018-11-07 | Create askama_escape crate |  bott | 1 | -11/+4 | |
| 2018-10-08 | Bump version to 0.7.2 | Dirkjan Ochtman | 1 | -1/+1 | |
| 2018-09-22 | Add absolute value filter | bott | 1 | -0/+1 | |
| 2018-07-23 | Bump versions to 0.7.1 | Dirkjan Ochtman | 1 | -1/+1 | |
| 2018-07-22 | Add optional implementation for actix_web's Responder trait |  Ryan McGrath | 1 | -0/+1 | |
| 2018-07-10 | Add partial support for multiple template dirs |  mash | 1 | -2/+4 | |
| 2018-06-22 | Bump version numbers to 0.7.0 | Dirkjan Ochtman | 1 | -1/+1 | |
| 2018-06-04 | Converted error-chain based error to enum based error |  Philipp Korber | 1 | -1/+0 | |
| - now implements `Send` + `Sync` + `'static` - still implements `std::error::Error`, `Debug`, `Display`, `From<std::fmt::Error>`, `From<::serde_json::Error>` | |||||
| 2018-04-18 | Version bump to 0.6.2 | Dirkjan Ochtman | 1 | -1/+1 | |
| 2018-04-12 | Bump version numbers to 0.6.1 | Dirkjan Ochtman | 1 | -1/+1 | |
| 2018-04-12 | Isolate proc-macro dependency to the proc macro |  David Tolnay | 1 | -3/+0 | |
| The dependency of askama on askama_shared on syn on libproc_macro used to mean libproc_macro would be dynamically linked into any crate using askama. We want only askama_derive to have a runtime dependency on proc macro. This commit moves all proc macro code from askama_shared into askama_derive so that the askama crate no longer dynamically links libproc_macro. | |||||
| 2018-04-12 | Bump version numbers to 0.6.0 | Dirkjan Ochtman | 1 | -1/+1 | |
| 2018-04-02 | Upgrade to latest syn and quote | Dirkjan Ochtman | 1 | -2/+2 | |
| 2018-01-09 | Upgrade to syn-0.12 and quote-0.4 | Dirkjan Ochtman | 1 | -2/+2 | |
| 2017-09-07 | Bump version number to 0.5.0 | Dirkjan Ochtman | 1 | -1/+1 | |
| 2017-09-06 | Update dependency on error-chain to 0.11 | Dirkjan Ochtman | 1 | -1/+1 | |
| 2017-09-06 | Add package metadata for new askama_shared crate | Dirkjan Ochtman | 1 | -0/+4 | |
| 2017-09-06 | Bump version number to 0.4.0 | Dirkjan Ochtman | 1 | -1/+1 | |
| 2017-08-27 | Move most of the code into new askama_shared crate | Dirkjan Ochtman | 1 | -0/+19 | |
| This makes it possible to share code between askama and askama_derive. | |||||
 |
index : askama | |
| [no description] | git repository hosting |
| aboutsummaryrefslogtreecommitdiffstats |