3 ms·

{{{message}}} in handlebars means that if someone one gets around your server-side sanitization your client side is wide open to XSS ... also, rate limit the u

{{{message}}} in handlebars means that if someone one gets around your server-side sanitization your client side is wide open to XSS ... also, rate limit the users, this is thing is managing to crash chrome!

anonfunction 13y ago
Working on it, any tips to keep entity encoding in handlebars without the triple stash?
- octatone2 13y ago
  Don't encode entities on the server side if you are using handlebars, it will do that for you (that's the point of using {{}} it will make all user input "safe").
- Sephr 13y ago
  Don't encode entities, just use the DOM (append text nodes).