Converts the tool chain to use babel, eslint, and webpack vs. the previous proprietary solutions.
Additionally begins enforcing additional linting concerns as well as updates the code to reflect these rules.
Fixes#855Fixes#993
Allows for us to play nicely in environments such as Node that could have multiple versions of the library loaded. Also allows for implementors to provide their own behavior, provided they know what they are doing.
Fixes#886
Using string.toString() will throw errors in current versions of Safari
(6.0.5 currently) for some values. The error is a particularly cryptic
"Type Error: type error", which no indication as to the value that
caused the error. By using the '' + string form of coercion the error
doesn't seem to occur.
Depending on the browser used there is a sizable performance increase
in using the concatenation form of coercion. In instances where there
is not a performance improvement (i.e. Firefox), the speed difference
is entirely negligable. See: http://jsperf.com/convert-to-string-bj/3
escapeExpression, when given a string like ">", was simply returning
">", not escaping the amperstand. This is incorrect, and makes it
impossible to have Handlebars properly escape a
string like "Escaped, <b> looks like: <b>"
If the intention of the user is to not escape these characters, then
{{{}}} or {{&}} should be used
It's probably fine not to escape /, since its only danger is in ending
entities (like &/). This isn't a problem for us, since the badChars
regex won't allow it and the & will get escaped.
It turns out ` can be used to quote attribute values in IE, so it needs
to be escaped along with " and '.
Previously, only < and > were escaped. This meant that any Handlebars
template that used user input in an HTML attribute value was wide open
to a trivial XSS exploit. Note that unquoted attribute values are still
open to attack, but this set of characters at least brings Handlebars in
line with other Mustache implementations and other template languages.
See the OWASP XSS prevention cheat sheet (rule #1) for the rationale
behind escaping these characters:
https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet
Nils Knappmeier
kpdecker
Blake Embrey
Parker Selbert
Yehuda Katz
Tommy Messbauer
Peter Wagenet
Brian Palmer
tomhuda
gleitz
Ryan Grove