Stop nunjucks from escaping HTML

javascript template-engine nunjucks
André Figueira picture André Figueira · Apr 25, 2015 · Viewed 11.3k times · Source

I have a comments AJAX call which returns data of the posted comment, I also have @mention functionality built in, the server side is processing the @mentions and doing a str_replace on the mentioned users replacing their names with an a tag within the response, for example:

{
   data: {
      comment: "<a href=\"profile/derp\">Username</a> hey what's up"
   }
}

However I can't seem to find in the documentation how to allow nunjucks to print this as actual HTML, it escapes it and displays the code instead of letting it be a real a tag.

Does anyone know how I can allow this to be printed as an actual a tag?

Answer

Andr&#233; Figueira picture André Figueira · Apr 25, 2015

OK so almost immediately after I posted this I found the answer! for anyone else looking it's simply this; within your template where you're printing your variable add the safe filter, which will disable automatic escaping.

{{ comment.content|safe }}

Although this means it's vulnerable to XSS injection, so make sure you add your protection on the server side.

Related questions

How to use underscore.js as a template engine?

I'm trying to learn about new usages of javascript as a serverside language and as a functional language. Few days ago I heard about node.js and express framework. Then I saw about underscore.js as a set of utility …

Read More
React.js: Wrapping one component into another

Many template languages have "slots" or "yield" statements, that allow to do some sort of inversion of control to wrap one template inside of another. Angular has "transclude" option. Rails has yield statement. If React.js had yield statement, it …

Read More
Is there a template engine for Node.js?

I'm experimenting with building an entire web application using Node.js. Is there a template engine similar to (for example) the Django template engine or the like that at least allows you to extend base templates?

Read More