Closed PEIYANGXINQU closed 10 months ago
All variables are HTML escaped by default. If you want to return unescaped HTML, use the triple mustache:
{{{name}}}
.You can also use
&
to unescape a variable:{{& name}}
. This may be useful when changing delimiters (see "Set Delimiter" below).
From manual.
In addition, you may want to directly ask mustache.js.
At first ,I use doT.js,It seems that doT do not check the input content.If the content is alert(999),then it will execute and alert the window. Now I change to use mustache.js.It seems OK.How do mustache avoid xss attack?