It's probably fine not to escape /, since its only danger is in ending
entities (like &/). This isn't a problem for us, since the badChars
regex won't allow it and the & will get escaped.
It turns out ` can be used to quote attribute values in IE, so it needs
to be escaped along with " and '.
Previously, only < and > were escaped. This meant that any Handlebars
template that used user input in an HTML attribute value was wide open
to a trivial XSS exploit. Note that unquoted attribute values are still
open to attack, but this set of characters at least brings Handlebars in
line with other Mustache implementations and other template languages.
See the OWASP XSS prevention cheat sheet (rule #1) for the rationale
behind escaping these characters:
https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet
Given the data {foo: []}, the following template previously considered
foo to be truthy when it shouldn't have:
{{#if foo}}
You should not see me!
{{else}}
You should see me!
{{/if}}
* made it possible to define an alternate name lookup scheme (so that {{foo}} does not have to be
context.foo, but can instead be something like context.get('foo'))
* made it possible to substitute an alternate buffer instead of the default empty String and override how
the compiled template appends to the buffer
* Added the concept of template-local data. In order to enable template-local data, pass true
as the second parameter to the template compiler. Then, pass in the data as the fourth
parameter (context, helpers, partials, data). These signatures may change before the 1.0 release.
Major TODOS:
* clean up a bunch of code duplication in the compiler
* reorganize the compiler
* add support for debug symbols which would make it possible
to provide information about what part of the source caused
a runtime error.
* add helperMissing.not to the specs
* add Handlebars.Utils.isEmpty
* add runtime handling for inverse sections
* fix __get__ to pass an IdNode to evaluate
* handle case in wrapProgram where context is undefined
* {{}} escape their contents, {{{}}} and {{& }} do not
* Add support in the parser, tokenizer and AST for partials
with context (support is still not there in the runtime)
* Fix some inconsistencies with the old behavior involving
the correct printing of null and undefined
* Add Handlebars.Exception
* Fixed an issue involving ./foo and this/foo
* Fleshed out helperMissing in the specs (this will be
moved out into handlebars proper once registerHelper
and registerPartial are added)
kpdecker
tomhuda
Alan Johnson
Ryan Grove
Yehuda Katz
Jason Davies
Raimonds Simanovskis