Using string.toString() will throw errors in current versions of Safari
(6.0.5 currently) for some values. The error is a particularly cryptic
"Type Error: type error", which no indication as to the value that
caused the error. By using the '' + string form of coercion the error
doesn't seem to occur.
Depending on the browser used there is a sizable performance increase
in using the concatenation form of coercion. In instances where there
is not a performance improvement (i.e. Firefox), the speed difference
is entirely negligable. See: http://jsperf.com/convert-to-string-bj/3
escapeExpression, when given a string like ">", was simply returning
">", not escaping the amperstand. This is incorrect, and makes it
impossible to have Handlebars properly escape a
string like "Escaped, <b> looks like: <b>"
If the intention of the user is to not escape these characters, then
{{{}}} or {{&}} should be used
It's probably fine not to escape /, since its only danger is in ending
entities (like &/). This isn't a problem for us, since the badChars
regex won't allow it and the & will get escaped.
It turns out ` can be used to quote attribute values in IE, so it needs
to be escaped along with " and '.
Previously, only < and > were escaped. This meant that any Handlebars
template that used user input in an HTML attribute value was wide open
to a trivial XSS exploit. Note that unquoted attribute values are still
open to attack, but this set of characters at least brings Handlebars in
line with other Mustache implementations and other template languages.
See the OWASP XSS prevention cheat sheet (rule #1) for the rationale
behind escaping these characters:
https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet
* add helperMissing.not to the specs
* add Handlebars.Utils.isEmpty
* add runtime handling for inverse sections
* fix __get__ to pass an IdNode to evaluate
* handle case in wrapProgram where context is undefined
* {{}} escape their contents, {{{}}} and {{& }} do not
* Add support in the parser, tokenizer and AST for partials
with context (support is still not there in the runtime)
* Fix some inconsistencies with the old behavior involving
the correct printing of null and undefined
* Add Handlebars.Exception
* Fixed an issue involving ./foo and this/foo
* Fleshed out helperMissing in the specs (this will be
moved out into handlebars proper once registerHelper
and registerPartial are added)
kpdecker
Blake Embrey
Parker Selbert
Yehuda Katz
Tommy Messbauer
Peter Wagenet
Brian Palmer
tomhuda
gleitz
Ryan Grove
David Stone