aboutsummaryrefslogtreecommitdiffstats
path: root/askama_escape (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Escape HTML fasterLibravatar René Kijewski2023-03-301-29/+23
| | | | | | | | | | | | | | | | | | | | | Escaped HTML characters vary in length. So, in order to select the correct replacement two variables need to be loaded: The pointer to the new substring and its length. Because of this the generated code is less dense than it could be. With this PR instead of selecting the appropriate `&str`, an `&&str` is selected. The former consumes two words while the latter consumes only one. Intuitively one might assume that the double dereference makes the code slower, but the optimized lookup seems to be so much faster, so that the change is worth its weight. Comparing the result of `cargo bench` (best out of three runs for both): ```text Old: [4.3592 µs 4.3675 µs 4.3764 µs] New: [3.8691 µs 3.8766 µs 3.8860 µs] Diff: [-11.24 % -11.24 % -12.21 % ] ```
* Apply clippy suggestions for 1.67 (#769)Libravatar Dirkjan Ochtman2023-01-302-3/+3
|
* Update criterion requirement from 0.3 to 0.4 (#721)Libravatar dependabot[bot]2022-09-261-1/+1
| | | | | | | | | | | | | | | | | Updates the requirements on [criterion](https://github.com/bheisler/criterion.rs) to permit the latest version. - [Release notes](https://github.com/bheisler/criterion.rs/releases) - [Changelog](https://github.com/bheisler/criterion.rs/blob/master/CHANGELOG.md) - [Commits](https://github.com/bheisler/criterion.rs/compare/0.3.0...0.4.0) --- updated-dependencies: - dependency-name: criterion dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Remove `unsafe { … }` code from askama_escapeLibravatar René Kijewski2022-04-131-50/+34
| | | | | | | | | | | | Using only safe code is actually same as fast as the previous "unsafe" code according to the crate's benchmark. The code was extracted from [markup]'s escape function in [escape.rs], written by Utkarsh Kukreti <utkarshkukreti@gmail.com>, licensed as `MIT OR Apache-2.0`. [markup]: https://crates.io/crates/markup [escape.rs]: https://github.com/utkarshkukreti/markup.rs/blob/8ec40428483790b2c296e907e7be4147b157fe8f/markup/src/escape.rs#L1-L21
* Increment patch versions of askama_{shared,escape}Libravatar René Kijewski2022-02-161-1/+1
|
* Make json filter safeLibravatar René Kijewski2022-02-162-4/+55
| | | | | | | | | | | | | | | | | | | | | Previously the built-in json filter had an issue that made it unsafe to use in HTML data. When used in HTML attributes an attacker who is able to supply an arbitrary string that should be JSON encoded could close the containing HTML element e.g. with `"</div>"`, and write arbitrary HTML code afterwards as long as they use apostrophes instead of quotation marks. The programmer could make this use case safe by explicitly escaping the JSON result: `{{data|json|escape}}`. In a `<script>` context the json filter was not usable at all, because in scripts HTML escaped entities are not parsed outside of XHTML documents. Without using the safe filter an attacker could close the current script using `"</script>"`. This PR fixes the problem by always escaping less-than, greater-than, ampersand, and apostrophe characters using their JSON unicode escape sequence `\u00xx`. Unless the programmer explicitly uses the safe filter, quotation marks are HTML encoded as `&quot`. In scripts the programmer should use the safe filter, otherwise not.
* Add `#![deny(unreachable_pub)]` to all cratesLibravatar René Kijewski2022-01-061-0/+1
|
* Omit implicit lifetimesLibravatar René Kijewski2022-01-061-2/+2
|
* Add `#[derive(Debug)]` for public typesLibravatar René Kijewski2022-01-061-0/+3
|
* Fix suggestions from nightly clippyLibravatar Dirkjan Ochtman2021-12-221-0/+1
|
* Remove authors from Cargo metadata (see RFC 3052)Libravatar Dirkjan Ochtman2021-11-241-1/+0
|
* Bump version numbers in anticipation of beta releaseLibravatar Dirkjan Ochtman2021-08-211-1/+1
|
* Stop eliding lifetimes in pathsLibravatar Dirkjan Ochtman2021-07-012-1/+2
|
* Remove forward-slash escape (#486)Libravatar Alex Wennerberg2021-05-171-1/+0
| | | | | | | | | | | | | | | This was based off of the OWASP XSS prevention cheat sheet -- https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html#output-encoding-rules-summary However, there isn't really any attack vector based on forward slash alone, and it's being removed in the next version of that document. > There is no proof that escaping forward slash will improve > defense against XSS, if all other special characters are escaped > properly, but it forces developers to use non-standard implementation of > the HTML escaping, what increases the risk of the mistake and makes the > implementation harder. https://github.com/OWASP/CheatSheetSeries/pull/516
* Add no_std support to askama_escapeLibravatar Wim Looman2021-01-151-3/+10
|
* Add askama_escape README to crate metadataLibravatar Dirkjan Ochtman2020-06-301-1/+2
|
* Add README files for subcratesLibravatar Dirkjan Ochtman2020-06-301-0/+9
|
* Bump version numbersLibravatar Dirkjan Ochtman2020-06-301-1/+1
|
* Add license files to each crate (fixes #339)Libravatar Dirkjan Ochtman2020-06-302-0/+2
|
* Update `EscapeWriter` HTML implementation to not output empty stringsLibravatar Ciprian Dorin Craciun2020-05-241-1/+5
|
* Remove obsolete CI badgesLibravatar Dirkjan Ochtman2020-01-151-2/+0
|
* Bump version numbers to 0.9.0Libravatar Dirkjan Ochtman2020-01-151-1/+1
|
* Update criterion requirement from 0.2 to 0.3Libravatar dependabot-preview[bot]2019-08-261-1/+1
| | | | | | | | Updates the requirements on [criterion](https://github.com/bheisler/criterion.rs) to permit the latest version. - [Release notes](https://github.com/bheisler/criterion.rs/releases) - [Changelog](https://github.com/bheisler/criterion.rs/blob/master/CHANGELOG.md) - [Commits](https://github.com/bheisler/criterion.rs/compare/0.2.0...0.3.0) Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
* Update formattingLibravatar Dirkjan Ochtman2019-07-251-4/+1
|
* Change askama_escape to require UTF-8 stringsLibravatar Ram Kaniyur2019-06-141-24/+25
|
* Bump versions in anticipation of 0.8.0 releaseLibravatar Dirkjan Ochtman2019-01-171-1/+1
|
* Specify a trait that handles the output format's escapingLibravatar Dirkjan Ochtman2019-01-122-61/+114
|
* Slightly simplify escaping codeLibravatar Dirkjan Ochtman2019-01-121-19/+21
|
* Improved rendering time (#190)Libravatar yossyJ2019-01-061-1/+23
| | | | | | * Improved rendering time * Fix useless codes
* Use 2018 edition idiomsLibravatar Dirkjan Ochtman2018-12-082-4/+3
|
* Upgrade to 2018 editionLibravatar Dirkjan Ochtman2018-12-081-0/+1
|
* Move escaping benchmarks into askama_escape crateLibravatar Dirkjan Ochtman2018-11-142-0/+85
|
* Tweak metadata for new askama_escape crateLibravatar Dirkjan Ochtman2018-11-071-2/+9
|
* Clean up unused featuresLibravatar Dirkjan Ochtman2018-11-071-7/+0
|
* Create askama_escape crateLibravatar bott2018-11-072-0/+116
generated by cgit (git 2.34.1) at 2024-11-25 07:18:09 +0000