It's probably fine not to escape /, since its only danger is in ending
entities (like &/). This isn't a problem for us, since the badChars
regex won't allow it and the & will get escaped.
It turns out ` can be used to quote attribute values in IE, so it needs
to be escaped along with " and '.
Previously, only < and > were escaped. This meant that any Handlebars
template that used user input in an HTML attribute value was wide open
to a trivial XSS exploit. Note that unquoted attribute values are still
open to attack, but this set of characters at least brings Handlebars in
line with other Mustache implementations and other template languages.
See the OWASP XSS prevention cheat sheet (rule #1) for the rationale
behind escaping these characters:
https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet
* add helperMissing.not to the specs
* add Handlebars.Utils.isEmpty
* add runtime handling for inverse sections
* fix __get__ to pass an IdNode to evaluate
* handle case in wrapProgram where context is undefined
* {{}} escape their contents, {{{}}} and {{& }} do not
* Add support in the parser, tokenizer and AST for partials
with context (support is still not there in the runtime)
* Fix some inconsistencies with the old behavior involving
the correct printing of null and undefined
* Add Handlebars.Exception
* Fixed an issue involving ./foo and this/foo
* Fleshed out helperMissing in the specs (this will be
moved out into handlebars proper once registerHelper
and registerPartial are added)
tomhuda
gleitz
Ryan Grove
David Stone
wycats