17

I use handlebars, and if an escaped character such as ' is processed it is rendered on screen as '.

I know wrapping the variable in a triple-stash will prevent this.

I processed the following string within a triple-stash as a quick test and it seemed fine "<p>hello<p>wouldn't wouldn&#39;t" This rendered to screen exactly how I wanted it to.

My question is, is it safe to simply wrap all variables in triple-stash? or will this have some unforeseen consequences I haven't considered?

Thanks

2
  • It's safe only when you have pre-escaped variables. Otherwise variables containing some kind of user-defined data may cause XSS vulnerability.
    – raidendev
    Jan 14, 2015 at 7:03
  • Thanks very much - A lot of this work is about Xss attacks so im hapy to accept if you want to make that an asnwer
    – DavidB
    Jan 14, 2015 at 9:10

1 Answer 1

38

By default all double-stashed {{var}} embeds in Handlebars will be HTML-escaped. It's performed for security reasons to avoid DOM XSS vulnerabilities. Because your variable may contain any data including user-data or any kind of untrusted data.

In some cases you will need to embed your data as-is, without escaping. There is where tripple-stash {{{var}}} used. But every time doing this, you need to think what may be in your data and can you trust it?

Read more about HTML Escaping on Handlebars site.

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.