From 9f40d906695104606fb60af901cf33c62420bdc3 Mon Sep 17 00:00:00 2001
From: Jeremy Olliver <jeremy.olliver@gmail.com>
Date: Sun, 11 Nov 2012 22:41:20 +1300
Subject: [PATCH] Fix ruby 1.8 compatibility, and beef up the javascript
 escaping

---
 lib/google_visualization.rb | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/lib/google_visualization.rb b/lib/google_visualization.rb
index effb25e..5fbfc27 100644
--- a/lib/google_visualization.rb
+++ b/lib/google_visualization.rb
@@ -145,13 +145,15 @@ def debugging?
 
   def escape(s)
     if s
-      s.gsub(/(?<!\\)'/, "\\'")
+      ERB::Util.json_escape(s)
     end
   end
 
   def escape_id(id)
     if id
-      id.gsub(/["'\s]/, "_")
+      # Let's be extra strict and validate for characters allowed in HTML id attribute.
+      # Allow word characters (letters and underscores), digits, dashes, colons and periods.
+      id.gsub(/[^\w\d-\:\.]/, "_")
     end
   end