Escaping bug

1st problem

1.

Params

{
    text: '<script>alert(1)<\/script>'
}

Template

{{text}}

Output

Empty string

2.

Params

{
    text: '<foo>alert(1)<\/foo>'
}

Template

{{text}}

Output

alert(1)

3.

Params

{
    text: '<foo>alert(1)</foo>'
}

Template

{{text}}

Output

<foo>alert(1)</foo>

Expected

Output

<foo>alert(1)</foo>

For all use-cases!

2nd problem

Params

{
    text: '<foo>alert(1)</foo>'
}

Template

{{{text}}}

Output

Error

Expected

<foo>alert(1)</foo>

Should work like Handlebars

[PetrToman]

Can we please have autoescaping turned on by a global option (so it doesn’t break legacy code)? Something like:

Template7.setAutoEscaping(true);

It would also require to provide a way not to escape a value - Handlebars uses “triple-stash” {{{ ... }}} and Handlebars.SafeString() in helpers.

[nolimits4web]

But at the moment is not an option as it is heavily used in Framework7, where i will need to up a major version too then )