fix: html encode backslashes if used with escape filter or autoescape (…

…mozilla/nunjucks#1437)

Backslashes should be html encoded when present in expressions that are
passed to the escape filter (including when this happens automatically
with autoescape)

---

Ported from mozilla/nunjucks@ec16d21

Co-Authored-By: Frankie Dintino <fdintino@gmail.com>

CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## [3.2.4] (unreleased)
+- Ported the upstream version v3.2.4
+ - HTML encode backslashes when expressions are passed through the escape
+ filter (including when this is done automatically with autoescape). Merge
+ of [#1427](https://github.com/mozilla/nunjucks/pull/1427).
+
 ## [3.2.3-2] (2022-11-03)
 - Removed unsupported options from type declarations
 

src/lib.js

@@ -7,9 +7,10 @@ const escapeMap = {
  "'": "'",
  "<": "&lt;",
  ">": "&gt;",
+ "\\": "&#92;",
 };
 
-const escapeRegex = /[&"'<>]/g;
+const escapeRegex = /[&"'<>\\]/g;
 
 export function hasOwnProp(obj, k) {
  return ObjProto.hasOwnProperty.call(obj, k);