Escaping bug about template7 HOT 10 OPEN

Can we please have autoescaping turned on by a global option (so it doesn't break legacy code)? Something like:

Template7.setAutoEscaping(true);

It would also require to provide a way not to escape a value - Handlebars uses "triple-stash" {{{ ... }}} and Handlebars.SafeString() in helpers.

from template7.

I am not sure did you really test it with Template7, because each of output is not what you get in Template7:

You write:
'<script>alert(1)<\/script>' -> Empty string
But actually:
'<script>alert(1)<\/script>' -> '<script>alert(1)</script>'

You write:
'<foo>alert(1)<\/foo>' -> Empty string
But actually:
'<foo>alert(1)<\/foo>' -> '<foo>alert(1)</foo>'

You write:
'&lt;foo&gt;alert(1)&lt;/foo&gt;' -> '<foo>alert(1)</foo>'
But actually:
'&lt;foo&gt;alert(1)&lt;/foo&gt;' -> '&lt;foo&gt;alert(1)&lt;/foo&gt;'

You write:
'<script>alert(1)<\/script>' -> Empty string
But actually:
'<script>alert(1)<\/script>' -> '<script>alert(1)</script>'

You write:
'<foo>alert(1)</foo>' + {{{text}}} -> Error
But actually:
'<foo>alert(1)</foo>' + {{{text}}} -> '{<foo>alert(1)</foo>}'

from template7.

Yeap, I can replicate it.

My bower file:

    "dependencies": {
        "framework7": "1.0.6",
        "template7" : "1.0.5",
        "handlebars": "3.0.3",
        "requirejs" : "2.1.18",
        "text"      : "2.0.14"
    }

from template7.

Ok, type in browser console:

Template7.compile('{{text}}')({text:'<script>alert(1)<\/script>'});

You will not see empty string as you wrote

from template7.

It's true.

I mean

Dom7('body').html(Template7.compile('{{text}}')({text:'<script>alert(1)<\/script>'}))

from template7.

This is a different. Template7 doesn't do any escaping like Handlebars. If you need it, you may use encode helper which is released in latest version, like {{encode text}}

from template7.

Actually the encoding should be used by default to prevent XSS-like attacks.
You'd pay attention to other template engines like Jade, Handlebars, Fest are used OWASP practice.

from template7.

Maybe, but if i add it now, it could bring a lot of breaking changes in existing apps and issues for all who use it like it is now

from template7.

Yep, you'd up the major version )

from template7.

But at the moment is not an option as it is heavily used in Framework7, where i will need to up a major version too then )

from template7.