Contextual Auto-escaping for JQuery Templates
I would like to try and make jquery templates more resistant to XSS attacks by looking at the context in which
${} appear and using that to choose an appropriate escaping directive.
Try choosing one of the "Safe HTML" examples from the dropdown at the top-right.
I'd like to make that work with jquery template syntax, handle
{{if}},
{{each}}, and
{{tmpl}} constructs by
branching and joining contexts and make it an option for jquery template users.
Is this something in which the jquery community might be interested?
I see the documentation at
http://api.jquery.com/category/plugins/templates/ but is there a more detailed grammar anywhere? Or a parser already built into the implementation?
Is there a public corpus of existing templates that I could use as test-fodder?
How close to static dispatch are
{{tmpl}} calls? Does one typically have access to callable templates the first time the caller is used?