exclude Handlebars.SafeString from escaping

YahooArchive / secure-handlebars

Handlebars Context Pre-compiler

BSD 3-Clause "New" or "Revised" License

45 stars 13 forks source link

Closed adon-at-work closed 9 years ago

adon-at-work commented 9 years ago

this implementation is handlebars-specific.

in case developers explicitly marked an input as safe, we will honor the setting and avoid applying any escaping to it.
for unsupported output expression contexts such as inside <script>, we align with Handlebars by applying exactly the default filter, i.e., Handlebars.escapeExpression()

yahoocla commented 9 years ago

CLA is valid!

neraliu commented 9 years ago

alright. the implementation of the filters are consistent with the implementation of handlebars.