Skip to content

Conversation

@fiirhok
Copy link

@fiirhok fiirhok commented Dec 13, 2024

Mustache supports Set Delimter tags, of the form {{=<open tag> <close tag>=}}, which is used to change the delimiters from {{ and }}. Prior to this commit, if there was a sequence that looked like the start of a Set Delimiter tag, but there was not a complete Set Delimiter tag, the library could panic.

This commit:
* factors out the Set Delimiter tag parsing into a new function, 'parseCustomDelimiter()'
* adds checks to make sure an incomplete tag doesn't cause an access off the end of a slice
* treats an incomplete Set Delimiter (like {{=}}) as a normaal tag

This behaviour matches the mustache playground at
https://jgonggrijp.gitlab.io/wontache/playground.html. I tried to match the behaviour of the Ruby implementation, but it seems to be inconsistent in this case.

Mustache supports Set Delimter tags, of the form `{{=<open tag> <close tag>=}}`,
which is used to change the delimiters from `{{` and `}}`. Prior to this
commit, if there was a sequence that looked like the start of a Set
Delimiter tag, but there was not a complete Set Delimiter tag, the
library could panic.

This commit:
    * factors out the Set Delimiter tag parsing into a new function,
      'parseCustomDelimiter()'
    * adds checks to make sure an incomplete tag doesn't cause an access
      off the end of a slice
    * treats an incomplete Set Delimiter (like `{{=}}`) as a normaal
      tag

This behaviour matches the mustache playground at
https://jgonggrijp.gitlab.io/wontache/playground.html. I tried to match
the behaviour of the Ruby implementation, but it seems to be
inconsistent in this case.
@cbroglie
Copy link
Owner

cbroglie commented Jan 6, 2025

Thanks for this @fiirhok. It looks like there's a failing test:

--- FAIL: TestBasic (0.00s)
    mustache_test.go:222: "{{ a }}{{=<% %>=}}<%b %><%={{ }}=%>{{ c }}" expected "abc" but got error "line 1: empty tag"
    mustache_test.go:222: "{{ a }}{{= <% %> =}}<%b %><%= {{ }}=%>{{c}}" expected "abc" but got error "line 1: empty tag"
panic: runtime error: slice bounds out of range [1:0] [recovered]
	panic: runtime error: slice bounds out of range [1:0]

The parse() method contains a check for 'unbalanced' custom
delimiter tags (i.e. tags that start with {{=, but don't have a
matching closing tag), and throws an error. However, wit the
new custom delimiter fix, those tags are treated as normal tags.
For example, `{{= %}}` is interpreted as a tag named `= %`, not
a malformed custom delimiter tag.

This commit removes the extra check that returns an error.
@fiirhok
Copy link
Author

fiirhok commented Jan 9, 2025

Whoops, I'm not sure how I missed that. I added a commit that should fix things.

@cbroglie cbroglie merged commit 6d0f72f into cbroglie:master Jan 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants