Fix ‘{{~’ completion for Handlebars

fxbois / web-mode

web template editing mode for emacs

https://web-mode.org

GNU General Public License v3.0

1.63k stars 262 forks source link

Fix ‘{{~’ completion for Handlebars #1248

Closed andersk closed 2 years ago

andersk commented 2 years ago

We should not autocomplete {{~ to {{~{ | }}}, as that unexpectedly disables HTML escaping in Handlebars, leading to cross-site scripting vulnerabilities.

Instead, autocomplete {{~ to {{~ | }} and {{~{ to {{~{ | }}}.

fxbois commented 2 years ago

thx