Fix ruby 1.8 compatibility, and beef up the javascript escaping

jeremyolliver · Nov 11, 2012 · 9f40d90 · 9f40d90
1 parent ab6f161
commit 9f40d90
Showing 1 changed file with 4 additions and 2 deletions.
diff --git a/lib/google_visualization.rb b/lib/google_visualization.rb
@@ -145,13 +145,15 @@ def debugging?
 
   def escape(s)
     if s
-      s.gsub(/(?<!\\)'/, "\\'")
+      ERB::Util.json_escape(s)
     end
   end
 
   def escape_id(id)
     if id
-      id.gsub(/["'\s]/, "_")
+      # Let's be extra strict and validate for characters allowed in HTML id attribute.
+      # Allow word characters (letters and underscores), digits, dashes, colons and periods.
+      id.gsub(/[^\w\d-\:\.]/, "_")
     end
   end