handlebars.js
handlebars.js copied to clipboard
Escaping in string literals is broken
String literals (when used, for example, as parameters in helper invocations) use single quotes (apostrophes) or double quotes as delimiters. The delimiter itself can be included in the literal by escaping it with a leading backslash. However, contrary to the usual practice, the backslash itself is not subject to escaping:
"some\"thing"
means some"thing
but "some\\thing"
means some\\thing
These rules make it impossible to end a literal with backslash: the delimiter that closes the literal that ends with backslash will be considered escaped and will thus be treated as part of the literal value, rather than the delimiter, and there is no way to prevent it. (Or at least I don't see it.)
I suggest to always allow escaping of exactly three characters: double quote "
, single quote '
and backslash \
, regardless of the used literal delimiter. This will be consistent, expected and reliable. The downside is breaking backward compatibility. A similar breaking change was already done in #397.
On a side note, I did not find any comprehensive documentation on how literals are interpreted, so I had to look at the code to find out.