Mirrors/lodash
1
0
Fork 0
mirror of https://github.com/whoisclebs/lodash.git synced 2026-02-11 03:17:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Make _.escape escape backticks as well

Browse Source 
In Internet Explorer ≤ 8, the backtick character can be used to break out of unquoted attribute values or HTML comments. See http://html5sec.org/#102, http://html5sec.org/#108, and http://html5sec.org/#133.
This commit is contained in:
Mathias Bynens
2014-05-23 10:38:05 +02:00
parent f4b34c8ca5
commit c875b61003
2 changed files with 13 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
lodash.js
View File

@@ -40,8 +40,8 @@
reEmptyStringTrailing = /(__e\(.*?\)|\b__t\)) \+\n'';/g; reEmptyStringTrailing = /(__e\(.*?\)|\b__t\)) \+\n'';/g;
/** Used to match HTML entities and HTML characters */ /** Used to match HTML entities and HTML characters */
var reEscapedHtml = /&(?:amp|lt|gt|quot|#39);/g, var reEscapedHtml = /&(?:amp|lt|gt|quot|#39|#96);/g,
reUnescapedHtml = /[&<>"']/g; reUnescapedHtml = /[&<>"'`]/g;
/** Used to match template delimiters */ /** Used to match template delimiters */
var reEscape = /<%-([\s\S]+?)%>/g, var reEscape = /<%-([\s\S]+?)%>/g,
@@ -157,13 +157,19 @@
* unless they're part of a tag or unquoted attribute value. * unless they're part of a tag or unquoted attribute value.
* See [Mathias' article](http://mathiasbynens.be/notes/ambiguous-ampersands) * See [Mathias' article](http://mathiasbynens.be/notes/ambiguous-ampersands)
* (under "semi-related fun fact") for more details. * (under "semi-related fun fact") for more details.
*
* Backticks are escaped because in Internet Explorer <= 8, they can be used
* to break out of unquoted attribute values or HTML comments. See
* <http://html5sec.org/#102>, <http://html5sec.org/#108>, and
* <http://html5sec.org/#133> for more details.
*/ */
var htmlEscapes = { var htmlEscapes = {
'&': '&amp;', '&': '&amp;',
'<': '&lt;', '<': '&lt;',
'>': '&gt;', '>': '&gt;',
'"': '&quot;', '"': '&quot;',
"'": '&#39;' "'": '&#39;',
'`': '&#96;'
}; };
/** Used to convert HTML entities to characters */ /** Used to convert HTML entities to characters */
@@ -172,7 +178,8 @@
'&lt;': '<', '&lt;': '<',
'&gt;': '>', '&gt;': '>',
'&quot;': '"', '&quot;': '"',
'&#39;': "'" '&#39;': "'",
'&#96;': '`'
}; };
/** /**

4
test/test.js
View File

@@ -2372,8 +2372,8 @@
QUnit.module('lodash.escape'); QUnit.module('lodash.escape');
(function() { (function() {
var escaped = '&amp;&lt;&gt;&quot;&#39;\/', var escaped = '&amp;&lt;&gt;&quot;&#39;&#96;\/',
unescaped = '&<>"\'\/'; unescaped = '&<>"\'`\/';
test('should escape values', 1, function() { test('should escape values', 1, function() {
strictEqual(_.escape(unescaped), escaped); strictEqual(_.escape(unescaped), escaped);