Fix XSS vulnerability by defaulting to Handlebars html_escape formatting

mkaczanowski / pastebin

Simple, fast, standalone pastebin service

MIT License

155 stars 27 forks source link

Closed erkiesken closed 3 years ago

erkiesken commented 3 years ago

Fixes #23.

This change will revert the no_escape override, and uses Handlebars raw output formatting {{{..}}} instead in the place it was needed.

Also bumped handlebars version just in case there are other fixes in there.

camdenorrb commented 3 years ago

So um, why is this not merged?

camdenorrb commented 3 years ago

Thxz <3