Added :sanitize_javascript template option

lib/haml/filters.rb

@@ -216,6 +216,10 @@ def render_with_options(text, options)
         text = text.rstrip
         text.gsub!("\n", "\n#{indent}")
 
+        if options[:sanitize_javascript]
+          text.gsub!(/<(\/)?script>/i, '')
+        end
+
         %!<script#{type}>\n#{"  //<![CDATA[\n" if options[:cdata]}#{indent}#{text}\n#{"  //]]>\n" if options[:cdata]}</script>!
       end
     end

lib/haml/options.rb

@@ -24,13 +24,15 @@ class Options
       :cdata                => false,
       :parser_class         => ::Haml::Parser,
       :compiler_class       => ::Haml::Compiler,
-      :trace                => false
+      :trace                => false,
+      :sanitize_javascript  => false
     }
 
     @valid_formats = [:html4, :html5, :xhtml]
 
     @buffer_option_keys = [:autoclose, :preserve, :attr_wrapper, :ugly, :format,
-      :encoding, :escape_html, :escape_attrs, :hyphenate_data_attrs, :cdata]
+      :encoding, :escape_html, :escape_attrs, :hyphenate_data_attrs, :cdata,
+      :sanitize_javascript]
 
     # The default option values.
     # @return Hash
@@ -177,6 +179,10 @@ def self.buffer_option_keys
     # the path will be the full path.
     attr_accessor :trace
 
+    # Escapes any <script> tags within the :javascript filters. This is an
+    # additional security against XSS
+    attr_accessor :sanitize_javascript
+
     def initialize(values = {}, &block)
       defaults.each {|k, v| instance_variable_set :"@#{k}", v}
       values.each {|k, v| send("#{k}=", v) if defaults.has_key?(k) && !v.nil?}

test/filters_test.rb

@@ -251,4 +251,4 @@ class RubyFilterTest < MiniTest::Unit::TestCase
     html = "7\n"
     assert_equal(html, render(haml))
   end
-end
+end