fix text nodes in .innerHTML-optimized output

- collapse whitespace to single space when appropriate (#2745)
- escape template string characters in script and style tags
pull/3069/head
Conduitry 5 years ago
parent 5e81280faa
commit 9bce3fc586

@ -335,6 +335,8 @@ export default class ElementWrapper extends Wrapper {
function to_html(wrapper: ElementWrapper | TextWrapper) {
if (wrapper.node.type === 'Text') {
if (wrapper.node.use_space) return ' ';
const parent = wrapper.node.parent as Element;
const raw = parent && (
@ -342,9 +344,9 @@ export default class ElementWrapper extends Wrapper {
parent.name === 'style'
);
return raw
return (raw
? wrapper.node.data
: escape_html(wrapper.node.data)
: escape_html(wrapper.node.data))
.replace(/\\/g, '\\\\')
.replace(/`/g, '\\`')
.replace(/\$/g, '\\$');

@ -2,7 +2,7 @@ export default {
html: `
<div>
<style>div { color: red; }</style>
<script>alert('<>');</script>
<script>alert(\`<>\`);</script>
</div>
`
};

@ -1,4 +1,4 @@
<div>
<style>div { color: red; }</style>
<script>alert('<>');</script>
<script>alert(`<>`);</script>
</div>
Loading…
Cancel
Save