Преглед изворни кода

Revert "Use ''' instead of ''', which showed in template output"

As reported by Chad Weider (Thanks!), the apostrophe should not be escaped as
"'" in HTML documents, but using a numeric entity "'" or "&#x27".

Unlike """, "'" has not beed defined in the W3C Recommendation
for HTML 4 [1].

References:

[1] HTML 4.01 Specification
§24.4.1 The list of characters
http://www.w3.org/TR/html4/sgml/entities.html#h-24.3.1

[2] Why shouldn't `'` be used to escape single quotes?
http://stackoverflow.com/questions/2083754
  /why-shouldnt-apos-be-used-to-escape-single-quotes

[3] OWASP - The Open Web Application Security Project
RULE #1 - HTML Escape Before Inserting Untrusted Data into HTML Element Content
"' is not recommended"
https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet#RULE_.231_-_HTML_Escape_Before_Inserting_Untrusted_Data_into_HTML_Element_Content

See details of the discussion on Github issue tracker:
https://github.com/janl/mustache.js/pull/166

This reverts commit e20cee5f3e.

Conflicts:

	mustache.js
tags/0.4.1
Eric Bréchemier пре 14 година
родитељ
комит
9f8937bd69
1 измењених фајлова са 1 додато и 1 уклоњено
  1. +1
    -1
      mustache.js

+ 1
- 1
mustache.js Прегледај датотеку

@@ -40,7 +40,7 @@ var Mustache = function () {
"<": "&lt;", "<": "&lt;",
">": "&gt;", ">": "&gt;",
'"': '&quot;', '"': '&quot;',
"'": '&apos;'
"'": '&#39;'
}; };


function escapeHTML(string) { function escapeHTML(string) {


Loading…
Откажи
Сачувај