Skip to content

fix: use triple-brace interpolation to prevent HTML-escaping #25

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
marc0olo wants to merge 1 commit into from
Closed

fix: use triple-brace interpolation to prevent HTML-escaping #25

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 7 additions & 3 deletions .claude/CLAUDE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ build:
steps:
- type: script
commands:
- command using {{ param }}
- command using {{{ param }}}

{{#if optional_param}}
- type: script
Expand All @@ -41,10 +41,14 @@ build:

## Key Patterns

### Triple-Brace Interpolation

Always use triple-braces `{{{ param }}}` for value interpolation. Handlebars double-braces `{{ param }}` HTML-escape the output (e.g. `&&` becomes `&&`), which breaks shell commands and is never correct in YAML/shell context.

### Required vs Optional Parameters

- **Required parameters**: Used directly as `{{ param }}` - will cause strict mode error if missing
- **Optional parameters**: Wrapped in conditionals `{{#if param}}{{ param }}{{/if}}`
- **Required parameters**: Used directly as `{{{ param }}}` - will cause strict mode error if missing
- **Optional parameters**: Wrapped in conditionals `{{#if param}}{{{ param }}}{{/if}}`

### Common Configuration Options

Expand Down
8 changes: 4 additions & 4 deletions recipes/asset-canister/recipe.hbs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,13 +19,13 @@ build:
- type: script
commands:
{{#each build}}
- {{ this }}
- {{{ this }}}
{{/each}}
{{/if}}

- type: pre-built
{{#if version}}
url: https://github.com/dfinity/sdk/releases/download/{{ version }}/assetstorage.wasm.gz
url: https://github.com/dfinity/sdk/releases/download/{{{ version }}}/assetstorage.wasm.gz
{{else}}
url: https://github.com/dfinity/sdk/releases/latest/download/assetstorage.wasm.gz
{{/if}}
Expand All @@ -34,12 +34,12 @@ build:
- type: script
commands:
{{#each metadata}}
- sh -c 'ic-wasm "$ICP_WASM_OUTPUT_PATH" -o "${ICP_WASM_OUTPUT_PATH}" metadata "{{ name }}" -d "{{ value }}" --keep-name-section'
- sh -c 'ic-wasm "$ICP_WASM_OUTPUT_PATH" -o "${ICP_WASM_OUTPUT_PATH}" metadata "{{{ name }}}" -d "{{{ value }}}" --keep-name-section'
{{/each}}
{{/if}}

{{! Synchronize assets }}
sync:
steps:
- type: assets
dir: {{ dir }}
dir: {{{ dir }}}
6 changes: 3 additions & 3 deletions recipes/motoko/recipe.hbs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ build:

- type: script
commands:
- sh -c '$(mops toolchain bin moc) "{{ main }}" {{#if args}}{{ args }} {{/if}}{{#if candid}}--omit-metadata{{else}}--public-metadata{{/if}} candid:service $(mops sources) -o "$ICP_WASM_OUTPUT_PATH"'
- sh -c '$(mops toolchain bin moc) "{{{ main }}}" {{#if args}}{{{ args }}} {{/if}}{{#if candid}}--omit-metadata{{else}}--public-metadata{{/if}} candid:service $(mops sources) -o "$ICP_WASM_OUTPUT_PATH"'

- type: script
commands:
Expand All @@ -29,11 +29,11 @@ build:
commands:
- ic-wasm "$ICP_WASM_OUTPUT_PATH" -o "${ICP_WASM_OUTPUT_PATH}" metadata "template:type" -d "motoko" --keep-name-section
{{#if candid}}
- ic-wasm "$ICP_WASM_OUTPUT_PATH" -o "${ICP_WASM_OUTPUT_PATH}" metadata "candid:service" -f '{{ candid }}' -v public --keep-name-section
- ic-wasm "$ICP_WASM_OUTPUT_PATH" -o "${ICP_WASM_OUTPUT_PATH}" metadata "candid:service" -f '{{{ candid }}}' -v public --keep-name-section
{{/if}}
{{#if metadata}}
{{#each metadata}}
- ic-wasm "$ICP_WASM_OUTPUT_PATH" -o "${ICP_WASM_OUTPUT_PATH}" metadata "{{ name }}" -d "{{ value }}" --keep-name-section
- ic-wasm "$ICP_WASM_OUTPUT_PATH" -o "${ICP_WASM_OUTPUT_PATH}" metadata "{{{ name }}}" -d "{{{ value }}}" --keep-name-section
{{/each}}
{{/if}}

Expand Down
6 changes: 3 additions & 3 deletions recipes/prebuilt/recipe.hbs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,16 +23,16 @@ build:
{{/if}}

- type: pre-built
path: {{ path }}
path: {{{ path }}}
{{#if sha256 }}
sha256: {{ sha256 }}
sha256: {{{ sha256 }}}
{{/if}}

{{#if metadata}}
- type: script
commands:
{{#each metadata}}
- ic-wasm "$ICP_WASM_OUTPUT_PATH" -o "${ICP_WASM_OUTPUT_PATH}" metadata "{{ name }}" -d "{{ value }}" --keep-name-section
- ic-wasm "$ICP_WASM_OUTPUT_PATH" -o "${ICP_WASM_OUTPUT_PATH}" metadata "{{{ name }}}" -d "{{{ value }}}" --keep-name-section
{{/each}}
{{/if}}

Expand Down
8 changes: 4 additions & 4 deletions recipes/rust/recipe.hbs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,21 +22,21 @@ build:
{{! We do this because the target directory might be outside of current directory if we are running in a cargo workspace }}
- type: script
commands:
- cargo build --package {{ package }} --target wasm32-unknown-unknown --release{{#if locked}} --locked{{/if}}
- TARGET_DIR=$(cargo metadata --format-version 1 --no-deps | sed -n 's/.*"target_directory":"\([^"]*\)".*/\1/p'); cp "${TARGET_DIR}/wasm32-unknown-unknown/release/{{ replace "-" "_" package }}.wasm" "$ICP_WASM_OUTPUT_PATH"
- cargo build --package {{{ package }}} --target wasm32-unknown-unknown --release{{#if locked}} --locked{{/if}}
- TARGET_DIR=$(cargo metadata --format-version 1 --no-deps | sed -n 's/.*"target_directory":"\([^"]*\)".*/\1/p'); cp "${TARGET_DIR}/wasm32-unknown-unknown/release/{{{ replace "-" "_" package }}}.wasm" "$ICP_WASM_OUTPUT_PATH"

- type: script
commands:
- ic-wasm "$ICP_WASM_OUTPUT_PATH" -o "${ICP_WASM_OUTPUT_PATH}" metadata "cargo:version" -d "$(cargo --version)" --keep-name-section
- ic-wasm "$ICP_WASM_OUTPUT_PATH" -o "${ICP_WASM_OUTPUT_PATH}" metadata "template:type" -d "rust" --keep-name-section
{{#if candid}}
- ic-wasm "$ICP_WASM_OUTPUT_PATH" -o "${ICP_WASM_OUTPUT_PATH}" metadata "candid:service" -f '{{ candid }}' -v public --keep-name-section
- ic-wasm "$ICP_WASM_OUTPUT_PATH" -o "${ICP_WASM_OUTPUT_PATH}" metadata "candid:service" -f '{{{ candid }}}' -v public --keep-name-section
{{else}}
- did="$(mktemp)"; candid-extractor "$ICP_WASM_OUTPUT_PATH" >"$did" && ic-wasm "$ICP_WASM_OUTPUT_PATH" -o "${ICP_WASM_OUTPUT_PATH}" metadata "candid:service" -f "$did" -v public --keep-name-section
{{/if}}
{{#if metadata}}
{{#each metadata}}
- ic-wasm "$ICP_WASM_OUTPUT_PATH" -o "${ICP_WASM_OUTPUT_PATH}" metadata "{{ name }}" -d "{{ value }}" --keep-name-section
- ic-wasm "$ICP_WASM_OUTPUT_PATH" -o "${ICP_WASM_OUTPUT_PATH}" metadata "{{{ name }}}" -d "{{{ value }}}" --keep-name-section
{{/each}}
{{/if}}

Expand Down
Loading