Skip to content

{{{something}} is interpreted as "do not escape" instead of syntax error #437

@AustinMontoya

Description

@AustinMontoya

In the example from the title, notice that the brackets aren't balanced; we're missing an additional closing '}'. However, rather than causing a syntax error, it interprets the syntax as being a valid "triple-stash", causing a possibly unintended xss vulnerability should someone accidentally fat-finger an extra curly bracket at the beginning.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions