XSS vulnerability

Nobody has claimed this yet.

While playing around with the filters on http://www.dustjs.com/docs/syntax/ under "{reference}" section, I noticed that if I change the value of "markup" to ``, the alert box pops up, and none of the filters (s, j, h) resolve the issue (Sorry it even came to hit and trial to see if I was missing anything on my end). Not sure if the team is aware of the issue, but wanted to put out there

Dust template:
{name} is a valid Dust reference.{~n}
{0name} is not a valid Dust reference.{~n}
{.name} is a valid Dust reference.{~n}
{.} is a valid dust reference.{~n}
{markup|h}: HTML is escaped by default.

Data:
{
"name": "name",
"0name": "0name",
"markup": ""
}

Compiled Dust:
(function(dust){dust.register("reference",body_0);function body_0(chk,ctx){return chk.f(ctx.get(["name"], false),ctx,"h").w(" is a valid Dust reference.\n{0name} is not a valid Dust reference.\n").f(ctx.getPath(true, ["name"]),ctx,"h").w(" is a valid Dust reference.\n").f(ctx.getPath(true, []),ctx,"h").w(" is a valid dust reference.\n").f(ctx.get(["markup"], false),ctx,"h",["h"]).w(": HTML is escaped by default.");}body_0.__dustBody=!0;return body_0}(dust));

Output:
name is a valid Dust reference.
{0name} is not a valid Dust reference.
name is a valid Dust reference.
[object Object] is a valid dust reference.
: HTML is escaped by default.

Reproduce the report in the `{reference}` section of http://www.dustjs.com/docs/syntax/ using the supplied Dust template and data, then inspect the generated compiled Dust shown in the issue. Done means the supplied markup no longer executes as script content and the documented escaping filters behave safely; verify the result in the same browser scenario.

Written by the indexing model from the issue text.