gabrielwalt/README.md

## README.md

      
    Raw
  

              README.md
            
          
    As Sightly only knows the syntax of HTML and not of JS or of CSS, it can automatically execute the appropriate escaping and cross-site scripting protection for expressions located in HTML, but it cannot do that for expressions located in JS or in CSS contexts. To remain as secure as possible, Sightly makes it mandatory to provide explicitly the context in those two contexts.
For Handlebar templates, this is unfortunate though as it is actually not JavaScript, but HTML that is located within the script elements, which Sightly would be able to parse properly. This trick shows that by separating the Handlebar script into a dedicated file, Sightly then parses that template as HTML again.
Without separating this example into two distinct files, the expression of the example should have been written as follows: ${properties.jcr:title @ context='text'}
The list of all available contexts can be found here: http://docs.adobe.com/content/docs/en/aem/6-0/develop/sightly.html#Display%20Context

  
## component.html
<script id="my-handlebar-template" type="text/x-handlebars-template" data-sly-include="handlebar.html"></script>

## handlebar.html
<body>
    <!--/* This output now works and doesn't need an explicit context to be defined */-->
    <p>${properties.jcr:title}</p>
</body>
	<body>
	<!--/* This output now works and doesn't need an explicit context to be defined */-->
	<p>${properties.jcr:title}</p>
	</body>