From 7cb2029ec2aac92ac9457666bcea8ed2c6b64fca Mon Sep 17 00:00:00 2001
From: Justin Hileman <justin@justinhileman.info>
Date: Wed, 8 Dec 2010 08:16:06 -0500
Subject: [PATCH] Add test for double-rendered sections, prevent mustache
 injection (see fix for mustache.js: http://hile.mn/fOVoW1 ...)

---
 test/MustacheTest.php | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/test/MustacheTest.php b/test/MustacheTest.php
index 69a2029..96c8174 100644
--- a/test/MustacheTest.php
+++ b/test/MustacheTest.php
@@ -350,4 +350,21 @@ class MustacheTest extends PHPUnit_Framework_TestCase {
 			array('{{#foo}}{{/bar}}{{/foo}}'),
 		);
 	}
+
+	/**
+	 * Ensure that Mustache doesn't double-render sections (allowing mustache injection).
+	 *
+	 * @group sections
+	 */
+	public function testMustacheInjection() {
+		$template = '{{#foo}}{{bar}}{{/foo}}';
+		$view = array(
+			'foo' => true,
+			'bar' => '{{win}}',
+			'win' => 'FAIL',
+		);
+
+		$m = new Mustache($template, $view);
+		$this->assertEquals('{{win}}', $m->render());
+	}
 }
\ No newline at end of file