Default HTML escaping vs triple-stache with external sanitization for user content

Answer

In a Handlebars environment the safest practice is to keep {{{ }}} for content that has already been passed through a trusted sanitization library (e.g., DOMPurify, sanitize-html). All other data should be rendered with the default {{ }} syntax, which automatically escapes HTML entities.

Enabling strictEscaping in production guarantees that accidental use of {{{ }}} does not bypass escaping unless the template explicitly marks a helper or variable as safe. The setting does not affect {{{ }}} itself; it only forces double‑brace expressions to escape.

Boundary for Raw HTML

• Source trust: Only data originating from a controlled, trusted source (e.g., CMS, admin UI) should be considered for raw output.
• Sanitization step: Apply a well‑maintained sanitization library that strips disallowed tags/attributes before the data reaches the template.
• Template contract: Document that any variable rendered with {{{ }}} is guaranteed to be sanitized. Use a custom helper that enforces this contract (e.g., {{{ safeHTML content }}}).
• Audit trail: Log or audit the use of {{{ }}} to ensure no accidental raw rendering of user input occurs.

Interaction with strictEscaping

• When strictEscaping is true, all {{ }} expressions escape; {{{ }}} remains raw.
• Disabling strictEscaping does not change the behavior of {{{ }}}, but it removes the safety net that double‑brace expressions would normally provide.
• Therefore, keep strictEscaping enabled in production and only use {{{ }}} for pre‑sanitized content.

Practical Steps

1. Configure your sanitization library to allow only the tags/attributes you need. Example with DOMPurify:

   import DOMPurify from 'dompurify';
   const clean = DOMPurify.sanitize(rawContent, {ALLOWED_TAGS: ['b','i','a'], ALLOWED_ATTR: ['href']});

2. Pass the sanitized string to the template via a helper that marks it as safe:

   Handlebars.registerHelper('safeHTML', function (content) {
     return new Handlebars.SafeString(content);
   });

3. In the template use {{{ safeHTML content }}} for raw output and {{ otherField }} for escaped output.
4. Enable strictEscaping: true in the Handlebars runtime configuration for all production servers.
5. Run a quick test: render a template that includes both {{{ }}} and {{ }} with a <script> payload. Verify that the script only appears in the triple‑stache output and that it is sanitized.

Missing Diagnostic Detail

To fine‑tune the sanitization rules, could you share which sanitization library you plan to use and the list of tags/attributes you intend to allow?