We use Handlebars templates to render data from one of our APIs. The data contains HTML entities - for example:
Police officers won’t be able to fine you until 10 minutes after your ticket expires
Till now we've used the Handlebars triple brace to let those through, like:
<p class="title">{{{title}}}</p>
But our hosting service provider tells us this is an XSS risk, and that values need to be escaped. They tell us to use {{ }} so Handlebars escapes them. But when we do this, the HTML entities show up in the front end as entity strings.
Can anyone suggest an easy way we can secure our client-side Handlebars templates against cross-site scripting while allowing HTML entities for the most typical UTF-8 characters like the non-breaking space ( ) and left single quote (‘)? I've come across Yahoo Secure Handlebars Helpers, but that seems to be intended only for use with their Handlebars Context Pre-compiler, which I'm not familiar with and anyway seems to be a server-side utility.
