documentcloud/underscore — Issue #394: Invert escape on templates
Author: sobrinho
Created: 2011-12-05 13:57:13+00:00
State: open

I think it's more safe.

Instead of:

``` javascript
_.template("hello <%= name %>", { name: "" })
// "hello "

_.template("hello <%- name %>", { name: "" })
// "hello <script>alert(1);</script>"
```

That:

``` javascript
_.template("hello <%= name %>", { name: "" })
// "hello <script>alert(1);</script>"

_.template("hello <%= raw(name) %>", { name: "" })
// "hello "
```

Obviously, it's backwards incompatible :)

Note how the rails behave:

``` erb
hello <%= name %>

Hello <%= raw name %>

```

We can do that just changing the `templateSettings` but would be nice if it's default ;)