why does _.escape modify / characters in Underscore.js?

Question

I was looking through the Underscore.js api and I noticed that _.escape escapes &, <, >, ", ', and / characters. What surprised me was escaping /.

Is there a reason to escape / characters that I don't know about?

Gnostic

Answer 1

EDIT: Alright, apparently, it is recommended by OWASP as it "helps end a HTML entity".

Escape the following characters with HTML entity encoding to prevent switching into any execution context, such as script, style, or event handlers. Using hex entities is recommended in the spec. In addition to the 5 characters significant in XML (&, <, >, ", '), the forward slash is included as it helps to end an HTML entity.

& --> &
< --> &lt;
> --> &gt;
" --> &quot;
' --> &#x27;     &apos; is not recommended
/ --> &#x2F;     forward slash is included as it helps end an HTML entity

Nalor

It doesn't change / to \/ it changes it to /. Besides, </script> would be changed to </script> which wouldn't be an issue. – Gnostic

@zzzzBov: Updated the answer with the citation. I found it out myself just now. – Nalor

and now that all makes sense :D – Gnostic

Answer 2

A lot of time passed but I found same issue. The strange is that the list of changes on the code are according to underscore github

var escapeMap = {
  '&': '&',
  '<': '&lt;',
  '>': '&gt;',
  '"': '&quot;',
  "'": '&#x27;',
  '`': '&#x60;'
};

Spermogonium