janl/mustache.js — pull request #192 by cweider (2012-03-31 01:32:57+00:00)
Title: Compilation Escaping #security

Some template token names can, at best, lead to bad code generation, or, at worst, allow script execution. This patch encodes these tokens as untrusted JavaScript String literals (instead of strings wrapped in quotes).

It requires a bit of ingenuity for user data work its way into a template, but should be corrected nonetheless. Apart from the unlikely case of accepting user templates (by some privileged rendering process), the most likely scenario is something like `"{{prefix}}" + escapeHTML(x) + "{{postfix}}" `, where escapeHTML is poorly written and allows quotes (and braces)*.

Corrects issue introduced in with eb01be04702388fd3cf98e509d3d14f1f9243f09.

*As some unfortunate internationalization tools do.