diff --git a/examples/unescaped_ampersand.html b/examples/unescaped_ampersand.html new file mode 100644 index 0000000..3bccbf9 --- /dev/null +++ b/examples/unescaped_ampersand.html @@ -0,0 +1 @@ +

{{&title}}

\ No newline at end of file diff --git a/examples/unescaped_ampersand.js b/examples/unescaped_ampersand.js new file mode 100644 index 0000000..11f30cc --- /dev/null +++ b/examples/unescaped_ampersand.js @@ -0,0 +1,5 @@ +var unescaped_ampersand = { + title: function() { + return "Bear > Shark"; + } +}; diff --git a/examples/unescaped_ampersand.txt b/examples/unescaped_ampersand.txt new file mode 100644 index 0000000..089ad79 --- /dev/null +++ b/examples/unescaped_ampersand.txt @@ -0,0 +1 @@ +

Bear > Shark

diff --git a/mustache.js b/mustache.js index ed72c16..d21058f 100644 --- a/mustache.js +++ b/mustache.js @@ -152,7 +152,7 @@ var Mustache = function() { var that = this; var new_regex = function() { - return new RegExp(that.escaped_otag + "(=|!|>|\\{|%)?([^\\/#\\^]+?)\\1?" + + return new RegExp(that.escaped_otag + "(=|!|>|\\{|&|%)?([^\\/#\\^]+?)\\1?" + that.escaped_ctag + "+", "g"); }; @@ -168,6 +168,7 @@ var Mustache = function() { case ">": // render partial return that.render_partial(name, context, partials); case "{": // the triple mustache is unescaped + case "&": // the ampersand is also unescaped return that.find(name, context); default: // escape the value return that.escape(that.find(name, context));