这是indexloc提供的服务,不要输入任何密码
Skip to content

Double braces {{ }} output do not replace forbidden code points #2069

@xmedeko

Description

@xmedeko

I have a string with invalid XML code point

var o = { name: "A\u0002B" }

And Handlebars.js template: {{name}} which outputs the string unchanged with U+0002 character between A and B. A web browser display such HTML somehow, but HTML validation https://validator.w3.org/nu/#textarea fails with: "Error: Forbidden code point U+0002".

See also:
https://stackoverflow.com/questions/79599889/handlebars-js-double-braces-output-forbidden-code-point

Is there any way how to make double braces to sanitise such input, e.g. replace invalid code points by Unicode replace char U+FFFD ? If not, is it possible to make a runtime option for that?

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions