From b8a14eafe9f260277ee03cc52c26901166045f81 Mon Sep 17 00:00:00 2001
From: Michael Jackson <mjijackson@gmail.com>
Date: Tue, 12 Jun 2012 14:51:43 -0700
Subject: [PATCH] Strict escaping of ampersands

---
 mustache.js                       | 2 +-
 test/_files/dot_notation.mustache | 4 ++--
 test/_files/escaped.mustache      | 2 +-
 test/_files/escaped.txt           | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/mustache.js b/mustache.js
index 0fef360..c5be0c9 100644
--- a/mustache.js
+++ b/mustache.js
@@ -63,7 +63,7 @@ var Mustache = (typeof module !== "undefined" && module.exports) || {};
   };
 
   function escapeHtml(string) {
-    return String(string).replace(/&(?!\w+;)|[<>"']/g, function (s) {
+    return String(string).replace(/[&<>"']/g, function (s) {
       return entityMap[s];
     });
   }
diff --git a/test/_files/dot_notation.mustache b/test/_files/dot_notation.mustache
index 138ddd0..f89d70b 100644
--- a/test/_files/dot_notation.mustache
+++ b/test/_files/dot_notation.mustache
@@ -1,8 +1,8 @@
 <!-- exciting part -->
 <h1>{{name}}</h1>
 <p>Authors: <ul>{{#authors}}<li>{{.}}</li>{{/authors}}</ul></p>
-<p>Price: {{price.currency.symbol}}{{price.value}} {{#price.currency}}{{name}} <b>{{availability.text}}</b>{{/price.currency}}</p>
-<p>VAT: {{price.currency.symbol}}{{#price}}{{vat}}{{/price}}</p>
+<p>Price: {{{price.currency.symbol}}}{{price.value}} {{#price.currency}}{{name}} <b>{{availability.text}}</b>{{/price.currency}}</p>
+<p>VAT: {{{price.currency.symbol}}}{{#price}}{{vat}}{{/price}}</p>
 <!-- boring part -->
 <h2>Test truthy false values:</h2>
 <p>Zero: {{truthy.zero}}</p>
diff --git a/test/_files/escaped.mustache b/test/_files/escaped.mustache
index ea25951..93e800b 100644
--- a/test/_files/escaped.mustache
+++ b/test/_files/escaped.mustache
@@ -1,2 +1,2 @@
 <h1>{{title}}</h1>
-But not {{entities}}.
+And even {{entities}}, but not {{{entities}}}.
diff --git a/test/_files/escaped.txt b/test/_files/escaped.txt
index 73ac5ce..2c3ad1f 100644
--- a/test/_files/escaped.txt
+++ b/test/_files/escaped.txt
@@ -1,2 +1,2 @@
 <h1>Bear &gt; Shark</h1>
-But not &quot;.
+And even &amp;quot;, but not &quot;.