fix(ui-templates): use escapeHTML from vue

pi0 · danielroe · danielroe · commit 8e4b8d62fef2 · 2025-04-29T00:05:49.000+01:00
Co-authored-by: Daniel Roe &lt;daniel@roe.dev&gt;
diff --git a/packages/ui-templates/lib/render.ts b/packages/ui-templates/lib/render.ts
@@ -98,16 +98,19 @@ export const RenderPlugin = () => {
         // Serialize into a js function
         const chunks = html.split(/\{{2,3}[^{}]+\}{2,3}/g).map(chunk => JSON.stringify(chunk))
         const hasMessages = chunks.length > 1
+        let hasExpression = false
         let templateString = chunks.shift()
         for (const [_, expression] of html.matchAll(/\{{2,3}([^{}]+)\}{2,3}/g)) {
           if (expression) {
-            templateString += ` + (${expression.trim()}) + ${chunks.shift()}`
+            hasExpression = true
+            templateString += ` + escapeHtml(${expression.trim()}) + ${chunks.shift()}`
           }
         }
         if (chunks.length > 0) {
           templateString += ' + ' + chunks.join(' + ')
         }
         const functionalCode = [
+          hasExpression ? 'import { escapeHtml } from \'@vue/shared\'\n' : '',
           hasMessages ? `export type DefaultMessages = Record<${Object.keys({ ...genericMessages, ...messages }).map(a => `"${a}"`).join(' | ') || 'string'}, string | boolean | number >` : '',
           hasMessages ? `const _messages = ${JSON.stringify({ ...genericMessages, ...messages })}` : '',
           `export const template = (${hasMessages ? 'messages: Partial<DefaultMessages>' : ''}) => {`,
diff --git a/packages/ui-templates/package.json b/packages/ui-templates/package.json
@@ -19,6 +19,7 @@
   "devDependencies": {
     "@types/lodash-es": "4.17.12",
     "@unocss/reset": "66.0.0",
+    "@vue/shared": "3.5.13",
     "beasties": "0.3.3",
     "html-validate": "9.5.3",
     "htmlnano": "2.1.1",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
