Autoescaping improvements

src/twig.core.js

@@ -914,7 +914,8 @@ module.exports = function (Twig) {
         for (i = 0; i < len; i++) {
             str = output[i];
 
-            if (str && (str.twig_markup !== true && str.twig_markup != strategy)) {
+            if (str && (str.twig_markup !== true && str.twig_markup !== strategy)
+                && !(strategy === 'html' && str.twig_markup === 'html_attr')) {
                 str = Twig.filters.escape(str, [ strategy ]);
             }
 
@@ -1294,13 +1295,13 @@ module.exports = function (Twig) {
                 }
 
                 if (!params) {
-                    return output;
+                    return output.valueOf();
                 } else if (params.output == 'blocks') {
                     return that.blocks;
                 } else if (params.output == 'macros') {
                     return that.macros;
                 } else {
-                    return output;
+                    return output.valueOf();
                 }
             });
         });

test/test.core.js

@@ -382,6 +382,27 @@ describe("Twig.js Core ->", function() {
             }).should.equal('\\x3Ctest\\x3E\\x26\\x3C\\x2Ftest\\x3E');
         });
 
+        it("should not auto escape html_attr within the html strategy", function() {
+            twig({
+                autoescape: 'html',
+                data: "{{ value|escape('html_attr') }}"
+            }).render({
+                value: '" onclick="alert(\\"html_attr\\")"'
+            }).should.equal('" onclick="alert(\"html_attr\")"');
+        });
+
+        it("should return a usable string after autoescaping", function() {
+            var result = twig({
+                autoescape: true,
+                data: '{{ value }}'
+            }).render({
+                value: '<test>&</test>'
+            });
+
+            (typeof result).should.equal('string');
+            result.valueOf().should.equal(result);
+        });
+
         it("should autoescape parent() output correctly", function() {
             twig({id: 'parent1', data: '{% block body %}<p>{{ value }}</p>{% endblock body %}'});
             twig({