Improve HTML escaping.

This closes a couple of potential exploit scenarios. Backtick (`) for older IEs and equals (=) for unquoted attributes. Refs handlebars-lang/handlebars.js@83b8e84 Closes #388
janl · Nov 17, 2015 · 378bcca · 378bcca
1 parent 53b1c95
commit 378bcca
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 4 deletions.
diff --git a/mustache.js b/mustache.js
@@ -63,11 +63,13 @@
     '>': '&gt;',
     '"': '&quot;',
     "'": '&#39;',
-    '/': '&#x2F;'
+    '/': '&#x2F;',
+    '`': '&#x60;',
+    '=': '&#x3D;'
   };
 
   function escapeHtml (string) {
-    return String(string).replace(/[&<>"'\/]/g, function fromEntityMap (s) {
+    return String(string).replace(/[&<>"'`=\/]/g, function fromEntityMap (s) {
       return entityMap[s];
     });
   }

diff --git a/test/_files/escaped.js b/test/_files/escaped.js
@@ -2,5 +2,5 @@
   title: function () {
     return "Bear > Shark";
   },
-  entities: "&quot; \"'<>/"
+  entities: "&quot; \"'<>`=/"
 })
diff --git a/test/_files/escaped.txt b/test/_files/escaped.txt
@@ -1,2 +1,2 @@
 <h1>Bear &gt; Shark</h1>
-And even &amp;quot; &quot;&#39;&lt;&gt;&#x2F;, but not &quot; "'<>/.
+And even &amp;quot; &quot;&#39;&lt;&gt;&#x60;&#x3D;&#x2F;, but not &quot; "'<>`=/.