Escape ` and = when escaping HTML.

They can be used for nefarious purposes on old IEs. Refs wycats/handlebars.js@83b8e84
2015-12-24 13:48:07 -08:00
parent ed15294419
commit 9eda17f85b
2 changed files with 6 additions and 3 deletions
@@ -15,7 +15,9 @@ public class Escapers
        { "'",  "&#39;" },
        { "\"", "&quot;" },
        { "<",  "&lt;" },
-        { ">",  "&gt;" }
+        { ">",  "&gt;" },
+        { "`",  "&#x60;" },
+        { "=",  "&#x3D;" }
    });

    /** An escaper that does no escaping. */