Skip to content

Security API

markSafe

Mark a string as safe (bypass auto-escaping).

const { markSafe } = require('miki-template');



const html = markSafe('<b>ok</b>');

// Will not be escaped

import { markSafe } from 'miki-template';



const html = markSafe('<b>ok</b>');

isSafe

Check if a value is marked safe.

const { isSafe } = require('miki-template');



if (isSafe(value)) {

  // value is marked safe

}

import { isSafe } from 'miki-template';



if (isSafe(value)) {

  // value is marked safe

}

escapeHtml

Escape HTML special characters (&, <, >, ", ', `).

const { escapeHtml } = require('miki-template');



const escaped = escapeHtml('<script>');

// Output: &lt;script&gt;

import { escapeHtml } from 'miki-template';



const escaped = escapeHtml('<script>');

Force-Escape SafeString

Pass true as the second argument to force-escape a SafeString (matching Django's |escape filter behavior):

const { escapeHtml, SafeString } = require('miki-template');



const safe = new SafeString('<b>bold</b>');

const forced = escapeHtml(safe, true);

// Output: &lt;b&gt;bold&lt;/b&gt;

import { escapeHtml, SafeString } from 'miki-template';



const safe = new SafeString('<b>bold</b>');

const forced = escapeHtml(safe, true);

stripExpressContext

Strip Express-specific framework keys (_, settings, cache) from a context object.

const { stripExpressContext } = require('miki-template');



const cleanCtx = stripExpressContext(expressOptions);

// Removes: _locals, settings, cache, and other _ prefixed keys

import { stripExpressContext } from 'miki-template';



const cleanCtx = stripExpressContext(expressOptions);

SafeString Class

Create a SafeString instance directly.

const { SafeString } = require('miki-template');



const safe = new SafeString('<b>ok</b>');

import { SafeString } from 'miki-template';



const safe = new SafeString('<b>ok</b>');

Path Traversal Protection

The extends and include tags validate that resolved template paths stay within configured views directories. Attempting to traverse outside throws an error:

{% extends "../../etc/passwd" %}  <!-- throws -->

{% include "../../secrets" %}     <!-- throws -->

Next Steps