diff --git a/mustache.js b/mustache.js index 3db6154..47def07 100644 --- a/mustache.js +++ b/mustache.js @@ -35,6 +35,15 @@ var Mustache = function () { } } + function escapeHTML(string) { + return String(string) + .replace(/&(?!\w+;)/g, "&") + .replace(//g, ">") + .replace(/"/g, """) + .replace(/'/g, "'"); + } + var regexCache = {}; var Renderer = function () {}; @@ -228,8 +237,6 @@ var Mustache = function () { // tit for tat var that = this; - - var new_regex = function () { return that.getCachedRegex("render_tags", function (otag, ctag) { return new RegExp(otag + "(=|!|>|\\{|%)?([^\\/#\\^]+?)\\1?" + ctag + "+", "g"); @@ -250,7 +257,7 @@ var Mustache = function () { case "{": // the triple mustache is unescaped return that.find(name, context); default: // escape the value - return that.escape(that.find(name, context)); + return escapeHTML(that.find(name, context)); } }; var lines = template.split("\n"); @@ -347,23 +354,6 @@ var Mustache = function () { return haystack.indexOf(this.otag + needle) != -1; }, - /* - Does away with nasty characters - */ - escape: function (s) { - s = String(s === null ? "" : s); - return s.replace(/&(?!\w+;)|["'<>\\]/g, function (s) { - switch(s) { - case "&": return "&"; - case '"': return '"'; - case "'": return '''; - case "<": return "<"; - case ">": return ">"; - default: return s; - } - }); - }, - // by @langalex, support for arrays of strings create_context: function (_context) { if (this.is_object(_context)) {