Enabling and Verifying Pug’s Auto‑Escape Feature in Node.js

Problem

When rendering HTML with Pug in a Node.js application, unescaped user input can become executable markup, opening an XSS vector. The safe default is auto‑escape, which converts <, >, ", ' into HTML entities. The task is to ensure this protection is active, verify it works, and know how to revert if needed.

Prerequisites

• A recent Node.js runtime (v14+ recommended).
• Pug version 2.0 or newer – older releases had inconsistent escaping behavior.
• Write access to the project directory where the template files reside.
• Permission to run npm commands (typically a user with sudo or project‑level access).

Step‑by‑step procedure

1. Install Pug (if not already present).

   cd /path/to/your/project
   npm install pug

   Run the command in the project root. No special permissions beyond standard npm rights are required.

2. Check the installed version.

   npm list pug

   Look for a version number ≥ 2.0. If the output shows 1.x.x, consider upgrading:

   npm install pug@latest

   Upgrading ensures the default autoescape:true behavior.

3. Create a test template. Save the following as test.pug:

   doctype html
   html
     head
       title Test
     body
       h1 Welcome, #{name}!
       p #{text}

   Replace #name and #text with values that contain characters requiring escaping, for example:

   #name = "