proper escaping of file attributes in js templates