Skip to content

Commit 3d0d991

Browse files
committed
Merge pull request tj#159 from visionmedia/ejs and add test
Original commit message: Fixed infinite loop problem in parse for unescaped ejs
1 parent 21a057d commit 3d0d991

File tree

4 files changed

+24
-5
lines changed

4 files changed

+24
-5
lines changed

ejs.js

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -193,8 +193,13 @@ var parse = exports.parse = function(str, options){
193193
postfix = "; buf.push('";
194194
}
195195

196-
var end = str.indexOf(close, i)
197-
, js = str.substring(i, end)
196+
var end = str.indexOf(close, i);
197+
198+
if (end < 0){
199+
throw new SyntaxError('Could not find matching close tag "' + close + '".');
200+
}
201+
202+
var js = str.substring(i, end)
198203
, start = i
199204
, include = null
200205
, n = 0;

ejs.min.js

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

lib/ejs.js

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -142,8 +142,13 @@ var parse = exports.parse = function(str, options){
142142
postfix = "; buf.push('";
143143
}
144144

145-
var end = str.indexOf(close, i)
146-
, js = str.substring(i, end)
145+
var end = str.indexOf(close, i);
146+
147+
if (end < 0){
148+
throw new SyntaxError('Could not find matching close tag "' + close + '".');
149+
}
150+
151+
var js = str.substring(i, end)
147152
, start = i
148153
, include = null
149154
, n = 0;

test/ejs.js

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -140,6 +140,15 @@ describe('<%-', function(){
140140
ejs.render('<%- name %>', { name: '<script>' })
141141
.should.equal('<script>');
142142
})
143+
144+
it('should terminate gracefully if no close tag is found', function(){
145+
try {
146+
ejs.compile('<h1>oops</h1><%- name ->')
147+
throw new Error('Expected parse failure');
148+
} catch (err) {
149+
err.message.should.equal('Could not find matching close tag "%>".');
150+
}
151+
})
143152
})
144153

145154
describe('%>', function(){

0 commit comments

Comments
 (0)