@bzzzz posted a new topic, subject "Compiled (⚡) blocks don't escape javascript strings". It read:

   in block means snap will generate javascript code from blocks put inside it
    
    javascript generator will just put text in quotes `asd` → `"asd"`  
    but string with special characters need to be escaped `\\\` → `\\\\\\\`  
    javascript generator doesn't do that

@cymplecy replied

    The zigzag means it's a compiled block and its a known issue that some compiled blocks don't work in all situations
    
    So, if it works for you - great - if it doesn't - don't use it

@jens replied

    thanks for the report! I've just deployed a little fix for this, you might want to hard reload Snap for your browser to update its cache.

After which, @spaceelephant added

    The problem is, this error creates a XSS vulnerability, giving a project full access to a user's account. Jens fixed it, so 7.2.4 is safe to use. However, it would be better for compiled blocks to only actually compile in javascript mode than to allow javascript to be used through compilation in normal mode.

So @bzzzz replied

    Yes, I did custom javascript execution in original post, but it's gone for some reason.
    
    edit: another post gone

To which @jens replied

    I forgot to also escape variable names, fixing this right now, thanks for the report!  
    A moderator probably deleted your reports here and notified me about them, so I could fix the issue, that's why your original examples that could execute arbitrary JS code are "gone" here. I really appreciate your brilliant analysis and your reports about them, they help make Snap better for all. Again thank you!  
    (I'm curious, you must be a professional programmer, right? kudos!)


{'source': 'discourse', 'url': 'https://forum.snap.berkeley.edu/t/compiled-blocks-dont-escape-javascript-strings/10125', 'title': "Compiled (⚡) blocks don't escape javascript strings", 'views': 179, 'has_accepted_answer': True, 'word_count': 270, 'like_count': 0, 'reply_count': 3, 'participant_count': 4, 'posts': 6, 'tags': 'technical', 'author': '@bzzzz', 'participants': '@bzzzz, @cymplecy, @jens, @spaceelephant', 'image_url': ['https://cdn.forum.snap.berkeley.edu/original/3X/c/e/ceab89558701721013865f50559675f9a5c016b9.png'], 'created_at': '2022-02-24T20:59:11.187Z', 'last_posted_at': '2022-02-26T08:09:24.835Z'}