# Watcher's mustache implementation does not appear to HTML escape values

**URL:** <https://discuss.elastic.co/t/watchers-mustache-implementation-does-not-appear-to-html-escape-values/31427>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [September 30, 2015, 9:11pm UTC](https://discuss.elastic.co/t/watchers-mustache-implementation-does-not-appear-to-html-escape-values/31427 "2015-09-30T21:11:16Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![aochsner](https://avatars.discourse-cdn.com/v4/letter/a/97f17d/32.png) [@aochsner](https://discuss.elastic.co/u/aochsner)\
**Post date:** [September 30, 2015, 9:11pm UTC](https://discuss.elastic.co/t/watchers-mustache-implementation-does-not-appear-to-html-escape-values/31427/1 "2015-09-30T21:11:16Z")

</div>

According to [https://mustache.github.io/mustache.5.html:](https://mustache.github.io/mustache.5.html:)  
All variables are HTML escaped by default.

I have some values that have angle-brackets in them (e.g. `<foo>`). But they won't render in an email body because it doesn't get html escaped and therefore get sanitized.

Here's a concrete example:

```auto
POST _watcher/watch/_execute
{
  "alternative_input" : {"foo": "<Bar>"},
  "action_modes" : {
    "_all" : "simulate" 
  },
  "watch" : {
    "trigger" : { "schedule" : { "interval" : "10s" } },
    "condition" : {
      "compare" : { "ctx.payload.foo" : { "eq" : "<Bar>" }}
    },
    "actions" : {
      "log_error" : {
        "logging" : {
          "text" : "Found {{ctx.payload.foo}} errors in the logs"
        }
      },
      "email_error" : {
        "email": {
              "to": "'John Doe <john.doe@example.com>'", 
              "subject": "{{ctx.watch_id}} executed", 
              "body": {
                "html" : "{{ctx.watch_id}} executed with {{ctx.payload.foo}} hits" 
              }
        }
      }
    }
  }
}

```

Response:

```auto
{
   "_id": "_inlined__0-2015-09-25T20:36:10.035Z",
   "watch_record": {
      "watch_id": "_inlined_",
      "state": "executed",
      "trigger_event": {
         "type": "manual",
         "triggered_time": "2015-09-25T20:36:10.035Z",
         "manual": {
            "schedule": {
               "scheduled_time": "2015-09-25T20:36:10.035Z"
            }
         }
      },
      "input": {
         "none": {}
      },
      "condition": {
         "compare": {
            "ctx.payload.foo": {
               "eq": "<Bar>"
            }
         }
      },
      "messages": [],
      "result": {
         "execution_time": "2015-09-25T20:36:10.035Z",
         "execution_duration": 20,
         "input": {
            "type": "simple",
            "status": "success",
            "payload": {
               "foo": "<Bar>"
            }
         },
         "condition": {
            "type": "compare",
            "status": "success",
            "met": true,
            "compare": {
               "resolved_values": {
                  "ctx.payload.foo": "<Bar>"
               }
            }
         },
         "actions": [
            {
               "id": "log_error",
               "type": "logging",
               "status": "simulated",
               "logging": {
                  "logged_text": "Found <Bar> errors in the logs"
               }
            },
            {
               "id": "email_error",
               "type": "email",
               "status": "simulated",
               "email": {
                  "message": {
                     "id": "_inlined__0-2015-09-25T20:36:10.035Z",
                     "sent_date": "2015-09-25T20:36:10.055Z",
                     "to": [
                        "'John Doe <john.doe@example.com>"
                     ],
                     "subject": "_inlined_ executed",
                     "body": {
                        "html": "_inlined_ executed with hits"
                     }
                  }
               }
            }
         ]
      }
   }
}

```

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [October 6, 2015, 9:46am UTC](https://discuss.elastic.co/t/watchers-mustache-implementation-does-not-appear-to-html-escape-values/31427/2 "2015-10-06T09:46:06Z")

</div>

Hey,

I tracked this down to the custom MustacheFactory used in Elasticsearch, and created an issue in core: [https://github.com/elastic/elasticsearch/issues/13959](https://github.com/elastic/elasticsearch/issues/13959)

Thanks for pointing it out!

--Alex

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:48pm UTC](https://discuss.elastic.co/t/watchers-mustache-implementation-does-not-appear-to-html-escape-values/31427/3 "2017-07-06T13:48:26Z")

</div>