Prevent escaping HTML tags inside variable
Nobody has claimed this yet.
- Dominant language
- Ruby
- Stars
- 11.9k
- Forks
- 1.5k
- Avg merge
- 17h 55m
- Merged PRs (30d)
- 3
Description
We have HTML inside an order attribute we'd like to output in a Liquid template in Shopify - specifically it's in order.attributes.
Just doing e.g. {{ order.attributes.myHtmlVariable }} is escaped - e.g. it outputs < and >
How do we make Liquid output the variable without escaping? I've tried {% raw %} but that only disables the processing of Liquid tags themselves.
It's possible Shopify automatically encodes the contents of order.attributes - in that case, how can we unescape the HTML when outputting?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing how Liquid renders {{ order.attributes.myHtmlVariable }} and where HTML escaping is applied. Reproduce the reported < and > output, then determine the expected safe behavior and add coverage for the chosen handling; the issue names no source file or existing test.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- html, ruby
- Domain
- security, web-dev
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100