Merge pull request #1080 from dvoytenko/mustache_patch1

Sync with upstream 378bcca8a5cfe4058f294a3dbb78e8755e8e0da5 that implements HTML escaping fix
ampproject · Dec 4, 2015 · bc42848 · bc42848
2 parents 2cce83d + aea8cb4
commit bc42848
Showing 1 changed file with 4 additions and 2 deletions.
diff --git a/third_party/mustache/mustache.js b/third_party/mustache/mustache.js
@@ -63,11 +63,13 @@
     '>': '&gt;',
     '"': '&quot;',
     "'": '&#39;',
-    '/': '&#x2F;'
+    '/': '&#x2F;',
+    '`': '&#x60;',
+    '=': '&#x3D;'
   };
 
   function escapeHtml (string) {
-    return String(string).replace(/[&<>"'\/]/g, function fromEntityMap (s) {
+    return String(string).replace(/[&<>"'`=\/]/g, function fromEntityMap (s) {
       return entityMap[s];
     });
   }