fix: escaping in action rule templating (#3632)

* fix: escaping in action rule templating * chore: release note
actualbudget · Oct 11, 2024 · 05dda5f · 05dda5f
1 parent 37ad584
commit 05dda5f
Show file tree

Hide file tree

Showing 3 changed files with 19 additions and 1 deletion.
diff --git a/packages/loot-core/src/server/accounts/rules.test.ts b/packages/loot-core/src/server/accounts/rules.test.ts
@@ -327,6 +327,16 @@ describe('Action', () => {
       expect(item.notes).toBe('Hey Sarah! You just payed 10');
     });
 
+    test('should not escape text', () => {
+      const action = new Action('set', 'notes', '', {
+        template: '{{notes}}',
+      });
+      const note = 'Sarah !@#$%^&*()<> Special';
+      const item = { notes: note };
+      action.exec(item);
+      expect(item.notes).toBe(note);
+    });
+
     describe('regex helper', () => {
       function testHelper(template: string, expected: unknown) {
         test(template, () => {

diff --git a/packages/loot-core/src/server/accounts/rules.ts b/packages/loot-core/src/server/accounts/rules.ts
@@ -565,7 +565,9 @@ export class Action {
       this.field = field;
       this.type = typeName;
       if (options?.template) {
-        this.handlebarsTemplate = Handlebars.compile(options.template);
+        this.handlebarsTemplate = Handlebars.compile(options.template, {
+          noEscape: true,
+        });
         try {
           this.handlebarsTemplate({});
         } catch (e) {

diff --git a/upcoming-release-notes/3632.md b/upcoming-release-notes/3632.md
@@ -0,0 +1,6 @@
+---
+category: Bugfix
+authors: [UnderKoen]
+---
+
+Fix escaping in action rules templating