linkedin/dustjs — pull request #193 by crypto (2012-11-14 21:21:18+00:00)
Title: Security update for lib/dust.js

dust.backwardCompatibility = 2; // unit tests compatible
// localStorage.setItem('dust.backwardCompatibility', 0); // all important chars encoded
// localStorage.setItem('dust.backwardCompatibility', 1); // compatible with
// localStorage.setItem('dust.backwardCompatibility', 2); // unit tests compatible (usual encoding, vulnerable)

dust.backwardCompatibility special variable for if it's true \ not encoded in HTML and <&" not encoded in JS just backspaced \"
We don't override JSON.stringify I just use dust.JSONstringify for js flag dust.JSONstringify({'test':'alert(\'1\')'}) with backwardCompatibility is {"test":"