Unescape HTML in Ember Helpers

Question

I have the following helper in my Ember app:

Ember.Handlebars.helper "social_profiles", ((person) ->
  person.social_profiles.map (item) ->
    " <a href=''> #{item.type_name}</a>"
), "social_profiles"

Each time I call the helper, it returns an escaped string, but I would like ember to display HTML links.

How can i achieve this?

Answer 1

You can mark a string as safe with new Handlebars.SafeString("<b>hello world</b>"). The steering will now not disappear.

However, you must be sure that your string is safe. As you pass in item.type_name, which may contain malicious code that would not be caught, as you declare the string as safe.

To solve this problem, first open the user input, and then wrap it in a tag that is marked for safe use.

:

Ember.Handlebars.registerHelper('boldItem', function(item) {
  var escaped = Handlebars.Utils.escapeExpression(item);
  return new Handlebars.SafeString("<b>" + escaped + "</b>");
});

Answer 2

@Ryan answer

Ember.Handlebars.helper "social_profiles", ((person) ->
  return new Handlebars.SafeString person.social_profiles.map (item) ->
    " <a href=''>#{item.type_name}</a>"
), "social_profiles"