Ryan Grove b291a1ad8c Add ", ', and / to the list of chars that need HTML escaping. ...

Previously, only < and > were escaped. This meant that any Handlebars
template that used user input in an HTML attribute value was wide open
to a trivial XSS exploit. Note that unquoted attribute values are still
open to attack, but this set of characters at least brings Handlebars in
line with other Mustache implementations and other template languages.

See the OWASP XSS prevention cheat sheet (rule #1) for the rationale
behind escaping these characters:

https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet

2011-04-25 11:15:53 -07:00

..

ast.js

Add Hash arguments to simple mustaches (TODO: add Hash args to block helpers)

2011-03-04 00:11:03 -08:00

base.js

inserting missing return statement in unless helper (fixes issue #51)

2011-03-09 11:51:00 +01:00

debug.js

Restructure things more simply

2010-12-29 18:21:43 -08:00

printer.js

Add Hash arguments to simple mustaches (TODO: add Hash args to block helpers)

2011-03-04 00:11:03 -08:00

runtime.js

Use prototype toString method to avoid native types being returned.

2011-01-17 15:42:27 -08:00

utils.js

Add ", ', and / to the list of chars that need HTML escaping.

2011-04-25 11:15:53 -07:00

visitor.js

Restructure things more simply

2010-12-29 18:21:43 -08:00

vm.js

DRY up some code that converts program AST nodes to opcodes.

2011-03-04 15:17:32 -08:00