Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Escape HTML from nodeValue #5

Closed
wants to merge 2 commits into from
Closed

Escape HTML from nodeValue #5

wants to merge 2 commits into from

Conversation

walruscow
Copy link

Tip: add ?w=0 to the diff to ignore whitespace (I removed trailing whitespace).

Added new functions to escape/unescape HTML entities &, ", ', <, >.

Page with example of previous behaviour (put in base directory to run).

<html>
  <head><title>Hello World</title></head>
  <body>
    <p id="test">Hello &lt;script&gt;alert('hi');&lt;/script&gt; World</p>
    <script src="shared/jquery-1.4.1.js"></script>
    <script src="jquery.ba-replacetext.js"></script>
    <script>
      $('#test').replaceText(/Hello/, '<span>Hello</span>');
    </script>
  </body>
</html>

Notice that with the original code, an alert is received, and the <script>alert('hi');</script> text disappears. With the new code, it remains, and no alert is received.

I'm no jQuery hacker or anything, but some code I'm working on was using this library and I finally traced the bug down to this plugin. We're using underscore so this was a much more minor change when I made it for us. Thought I'd push it back to you in case you want it.

@cburschka
Copy link

Ouch! Just ran into this bug yesterday on (cburschka/cadence#192) and had to add an emergency workaround. I suppose I'll switch to your fork in the next version.

@Scharrels Scharrels mentioned this pull request Jul 15, 2015
Merged
@walruscow walruscow closed this by deleting the head repository Aug 19, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@walruscow @cburschka