| @@ -35,6 +35,15 @@ var Mustache = function () { | |||||
| } | } | ||||
| } | } | ||||
| function escapeHTML(string) { | |||||
| return String(string) | |||||
| .replace(/&(?!\w+;)/g, "&") | |||||
| .replace(/</g, "<") | |||||
| .replace(/>/g, ">") | |||||
| .replace(/"/g, """) | |||||
| .replace(/'/g, "'"); | |||||
| } | |||||
| var regexCache = {}; | var regexCache = {}; | ||||
| var Renderer = function () {}; | var Renderer = function () {}; | ||||
| @@ -228,8 +237,6 @@ var Mustache = function () { | |||||
| // tit for tat | // tit for tat | ||||
| var that = this; | var that = this; | ||||
| var new_regex = function () { | var new_regex = function () { | ||||
| return that.getCachedRegex("render_tags", function (otag, ctag) { | return that.getCachedRegex("render_tags", function (otag, ctag) { | ||||
| return new RegExp(otag + "(=|!|>|\\{|%)?([^\\/#\\^]+?)\\1?" + ctag + "+", "g"); | return new RegExp(otag + "(=|!|>|\\{|%)?([^\\/#\\^]+?)\\1?" + ctag + "+", "g"); | ||||
| @@ -250,7 +257,7 @@ var Mustache = function () { | |||||
| case "{": // the triple mustache is unescaped | case "{": // the triple mustache is unescaped | ||||
| return that.find(name, context); | return that.find(name, context); | ||||
| default: // escape the value | default: // escape the value | ||||
| return that.escape(that.find(name, context)); | |||||
| return escapeHTML(that.find(name, context)); | |||||
| } | } | ||||
| }; | }; | ||||
| var lines = template.split("\n"); | var lines = template.split("\n"); | ||||
| @@ -347,23 +354,6 @@ var Mustache = function () { | |||||
| return haystack.indexOf(this.otag + needle) != -1; | return haystack.indexOf(this.otag + needle) != -1; | ||||
| }, | }, | ||||
| /* | |||||
| Does away with nasty characters | |||||
| */ | |||||
| escape: function (s) { | |||||
| s = String(s === null ? "" : s); | |||||
| return s.replace(/&(?!\w+;)|["'<>\\]/g, function (s) { | |||||
| switch(s) { | |||||
| case "&": return "&"; | |||||
| case '"': return '"'; | |||||
| case "'": return '''; | |||||
| case "<": return "<"; | |||||
| case ">": return ">"; | |||||
| default: return s; | |||||
| } | |||||
| }); | |||||
| }, | |||||
| // by @langalex, support for arrays of strings | // by @langalex, support for arrays of strings | ||||
| create_context: function (_context) { | create_context: function (_context) { | ||||
| if (this.is_object(_context)) { | if (this.is_object(_context)) { | ||||