Преглед на файлове

Revert "Use ''' instead of ''', which showed in template output"

As reported by Chad Weider (Thanks!), the apostrophe should not be escaped as
"'" in HTML documents, but using a numeric entity "'" or "&#x27".

Unlike """, "'" has not beed defined in the W3C Recommendation
for HTML 4 [1].

References:

[1] HTML 4.01 Specification
§24.4.1 The list of characters
http://www.w3.org/TR/html4/sgml/entities.html#h-24.3.1

[2] Why shouldn't `'` be used to escape single quotes?
http://stackoverflow.com/questions/2083754
  /why-shouldnt-apos-be-used-to-escape-single-quotes

[3] OWASP - The Open Web Application Security Project
RULE #1 - HTML Escape Before Inserting Untrusted Data into HTML Element Content
"' is not recommended"
https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet#RULE_.231_-_HTML_Escape_Before_Inserting_Untrusted_Data_into_HTML_Element_Content

See details of the discussion on Github issue tracker:
https://github.com/janl/mustache.js/pull/166

This reverts commit e20cee5f3e.

Conflicts:

	mustache.js
tags/0.4.1
Eric Bréchemier преди 14 години
родител
ревизия
9f8937bd69
променени са 1 файла, в които са добавени 1 реда и са изтрити 1 реда
  1. +1
    -1
      mustache.js

+ 1
- 1
mustache.js Целия файл

@@ -40,7 +40,7 @@ var Mustache = function () {
"<": "&lt;",
">": "&gt;",
'"': '&quot;',
"'": '&apos;'
"'": '&#39;'
};

function escapeHTML(string) {


Loading…
Отказ
Запис