Is Mustache XSS-proof?

Question

I was thinking about my app's XSS vulnerability. On the server side I don't sanitize either input or output, so

<script>alert(document.cookies)</script>

is stored in database exactly so. To view this value on the client side I use Mustache. If this script was executed by an admin, it is of course easy to hijack his session. However I've noticed that Mustache by default escapes these values & \ " < > when you use the {{}} syntax. Do I need to worry about XSS, when the value from the database would be inserted into

<p>{{value}}</p>

or even

<p data-id='{{value}}'>something</p>

? Should I perhaps review my Mustache templates to look for any vulnerable code, or unless I'd use

<script>{{value}}</script>

I am safe?

Answer 1

Well, you should always worry :) But yes, Mustache accomplishes the goal you are talking about here, protecting your examples from XSS (except where you're outputting the value directly into a <script> tag).

Note: check that the Mustache implementation you're using escapes single quotes. It's apparently not in the spec to do so (https://github.com/mustache/spec/issues/69) but the major implementations thankfully escape it anyway.