Hacker News new | ask | show | jobs
by rtpg 3445 days ago
Yeah, this problem is basically unsolvable if you wish to have { characters anywhere in your page from server-side rendering.

- Have the possibility of {{ and }} in your server-side output (or whatever symbols you configured Angular for)

- Have Angular.JS on a page with server-side output

Choose one.

It's important to realize that this affects things like user input as well. So form initials/form defaults can also be affected by this issue!

A bit of a silly way to fix this problem is to modify your server-side escaping function (surely you have this!) to "escape" {{ with {<zero-width space>{. This will mess up things that need to be equal to each other, and can poison user input (because of form initials) but will protect you from this issue.
1 comments
catmanjan 3445 days ago
If you're displaying user input you could just encode to their matching HTML entities...

&#123; or the human friendlier one &rcurb (?)

link
rtpg 3445 days ago
that doesn't work because the HTML entity decoding happens before Angular does the scanning of the DOM for the brackets. So even if you use &rcurb; output from the server, Angular will still interpret the brackets "properly"

As to why this works this way, consider the following:

do you have to do HTML entity decoding when getting an input value from Javascript?

link