search

fhd / clostache

{{ mustache }} for Clojure
GNU Lesser General Public License v3.0
318 stars 62 forks source link

Now HTML escapes single quotes #45

Closed jimmythompson closed 7 years ago

jimmythompson commented 9 years ago

Using a moustache inside a HTML attribute wrapped with single quotes will allow a user to execute malicious JavaScript because Clostache doesn't escape single quotes.

Example: <a href='/user/{{username}}'>{{username}}</a> can be easily escaped if username was set to foo' onmouseover='alert(1).

We should also be escaping more characters due to the crazy nature in which people can write renderable HTML, but single quoted attributes is a pretty common thing.

Reference: http://wonko.com/post/html-escaping

fhd commented 7 years ago

Thanks! Sorry for letting this sit so long :disappointed: You're right, the escaping logic is a bit naive, I've added an issue for rethinking it: #53.