Do not auto-html-escape custom function results. (#908)

Fixes #906
smarty-php · Nov 6, 2023 · bc4e70f · bc4e70f
1 parent b28b85d
commit bc4e70f
Show file tree

Hide file tree

Showing 3 changed files with 33 additions and 1 deletion.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Fixed
 - Registered output filters wouldn't run [#899](https://github.com/smarty-php/smarty/issues/899)
 - Use of negative numbers in {math} equations [#895](https://github.com/smarty-php/smarty/issues/895)
+- Do not auto-html-escape custom function results [#906](https://github.com/smarty-php/smarty/issues/906)
 - Fix case-sensitive tag names [#907](https://github.com/smarty-php/smarty/issues/907)
 
 ### Removed

diff --git a/src/Compiler/Template.php b/src/Compiler/Template.php
@@ -1143,7 +1143,7 @@ private function compileTag2($tag, $args, $parameter) {
 		if ($this->smarty->getFunctionHandler($base_tag)) {
 			if (!isset($this->smarty->security_policy) || $this->smarty->security_policy->isTrustedTag($base_tag, $this)) {
 				return (new \Smarty\Compile\PrintExpressionCompiler())->compile(
-					[],
+					['nofilter'], // functions are never auto-escaped
 					$this,
 					['value' =>	$this->compileFunctionCall($base_tag, $args, $parameter)]
 				);

diff --git a/tests/UnitTests/A_Core/AutoEscape/AutoEscapeTest.php b/tests/UnitTests/A_Core/AutoEscape/AutoEscapeTest.php
@@ -30,4 +30,35 @@ public function testAutoEscape()
         $tpl->assign('foo', '<a@b.c>');
         $this->assertEquals("&lt;a@b.c&gt;", $this->smarty->fetch($tpl));
     }
+
+    /**
+     * test 'escapeHtml' property
+     * @group issue906
+     */
+    public function testAutoEscapeDoesNotEscapeFunctionPlugins()
+    {
+        $this->smarty->registerPlugin(
+            \Smarty\Smarty::PLUGIN_FUNCTION,
+            'horizontal_rule',
+            function ($params, $smarty)	{ return "<hr>"; }
+        );
+        $tpl = $this->smarty->createTemplate('eval:{horizontal_rule}');
+        $this->assertEquals("<hr>", $this->smarty->fetch($tpl));
+    }
+
+    /**
+     * test 'escapeHtml' property
+     * @group issue906
+     */
+    public function testAutoEscapeDoesNotEscapeBlockPlugins()
+    {
+        $this->smarty->registerPlugin(
+            \Smarty\Smarty::PLUGIN_BLOCK,
+            'paragraphify',
+            function ($params, $content)	{ return $content == null ? null :  "<p>".$content."</p>"; }
+        );
+        $tpl = $this->smarty->createTemplate('eval:{paragraphify}hi{/paragraphify}');
+        $this->assertEquals("<p>hi</p>", $this->smarty->fetch($tpl));
+    }
+
 }