As reported by Chad Weider (Thanks!), the apostrophe should not be escaped as
"'" in HTML documents, but using a numeric entity "'" or "'".
Unlike """, "'" has not beed defined in the W3C Recommendation
for HTML 4 [1].
References:
[1] HTML 4.01 Specification
§24.4.1 The list of characters
http://www.w3.org/TR/html4/sgml/entities.html#h-24.3.1
[2] Why shouldn't `'` be used to escape single quotes?
http://stackoverflow.com/questions/2083754
/why-shouldnt-apos-be-used-to-escape-single-quotes
[3] OWASP - The Open Web Application Security Project
RULE #1 - HTML Escape Before Inserting Untrusted Data into HTML Element Content
"' is not recommended"
https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet#RULE_.231_-_HTML_Escape_Before_Inserting_Untrusted_Data_into_HTML_Element_Content
See details of the discussion on Github issue tracker:
https://github.com/janl/mustache.js/pull/166
This reverts commit e20cee5f3e.
Conflicts:
mustache.js
tags/0.4.1