Skip to content
This repository was archived by the owner on Sep 5, 2018. It is now read-only.

Commit 80b01d4

Browse files
committed
Update README.md
1 parent c5f4437 commit 80b01d4

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -102,7 +102,7 @@ npm test
102102
- We now assume that `{{>partial}}` and `{{{{rawblock}}}}` is always placed in the HTML Data context, and by itself will result in the same Data context after its binding (hence, in-state and out-state are both of the data context).
103103

104104
### Warnings and Workarounds
105-
When output expressions are found inside dangerous (yet-to-be-supported) contexts, we echo warnings and gracefully fallback to apply the default Handlebars [`escapeExpression()`](http://handlebarsjs.com/#html-escaping). These warnings are indications of potential security exploits, and thus require closer inspections. Instead of simply abusing raw expressions to supress the warnings, here are some alternative suggestions to secure your applications.
105+
When output expressions are found inside dangerous (yet-to-be-supported) contexts, we echo warnings and gracefully fallback to apply the default Handlebars [`escapeExpression()`](http://handlebarsjs.com/#html-escaping). These warnings are indications of potential security exploits, and thus require closer inspections. Instead of simply abusing raw expressions to suppress the warnings, here are some alternative suggestions to secure your applications.
106106
- Output placeholder in the `<script>` tag:
107107
```html
108108
<!-- Rewrite <script>var strJS = {{strJS}};</script> as: -->

0 commit comments

Comments
 (0)