Another template "engine" for JavaScript

template.js

function compile(template) {
  function expandFilter(expr) { return expr.replace(/^(.+?)(?:|(\|[^()]+))?$/, function ($0, expr, filters) {
    if (!filters) return expr;
    filters = filters.split(/\s*\|\s*/g).reverse();
    return filters.join('(') + '(' + expr + filters.map(function () { return ')'; }).join('');
  }); }
  return new Function(
    'with(this){with(arguments[0]){var out="' +
    template.replace(/\\([@{}\\])|\{\{\s*([^]+?)\s*\}\}|^\s*@\s*(.+)|([^])/gm,
      function ($0, escaped, expr, stat, ch) {
        return expr ? '"+((' + expandFilter(expr) + ')+"").replace(/&/,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;")+"' :
               stat ? '";' + stat + ';out+="' :
               (ch || escaped).replace(/["\\]/g, '\\$&').replace(/[\r\n]/g, '\\n');
      }) +
    '";return out;}}'
  );
}

let ctx = {
  upper: Function.prototype.call.bind(''.toUpperCase),
  lower: Function.prototype.call.bind(''.toLowerCase)
};
console.log(compile(`
  <h1>{{ title }}</h1>
  @ for (let feature of features) {
    <dl>
      <dt>{{ upper(feature.name) }}</dt>
      <dd>{{ feature.desc | lower }}</dd>
    </dl>
  @ }
  \\@That \\\\ I won't be \\{{ parsed }}.
`).call(ctx, {
  title: 'micro.template.js<script>alert("XSS!!!");</script>',
  features: [
    { name: 'Lightweight & Lightweight', desc: '533 bytes (uglified)' },
    { name: '...', desc: 'However...I have no idea why I have to use this' }
  ]
}));