psimsa/handlebars.js
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Escape = in HTML content

Browse Source 
There was a potential XSS exploit when using unquoted attributes that this should help reduce.

Fixes #1083
This commit is contained in:
kpdecker
2015-09-01 01:44:35 -05:00
committed by Hannah Wolfe
parent 891f48b7e9
commit 1c863e34ab
2 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/handlebars/utils.js
+4 -3
View File
@@ -4,11 +4,12 @@ const escape = {
'>': '>', '>': '>',
'"': '"', '"': '"',
"'": ''', "'": ''',
'`': '`' '`': '`',
'=': '='
}; };
const badChars = /[&<>"'`]/g, const badChars = /[&<>"'`=]/g,
possible = /[&<>"'`]/; possible = /[&<>"'`=]/;
function escapeChar(chr) { function escapeChar(chr) {
return escape[chr]; return escape[chr];
spec/utils.js
+1
View File
@@ -18,6 +18,7 @@ describe('utils', function() {
describe('#escapeExpression', function() { describe('#escapeExpression', function() {
it('shouhld escape html', function() { it('shouhld escape html', function() {
equals(Handlebars.Utils.escapeExpression('foo<&"\'>'), 'foo&lt;&amp;&quot;&#x27;&gt;'); equals(Handlebars.Utils.escapeExpression('foo<&"\'>'), 'foo&lt;&amp;&quot;&#x27;&gt;');
equals(Handlebars.Utils.escapeExpression('foo='), 'foo&#x3D;');
}); });
it('should not escape SafeString', function() { it('should not escape SafeString', function() {
var string = new Handlebars.SafeString('foo<&"\'>'); var string = new Handlebars.SafeString('foo<&"\'>');