[asp.net] ScriptResourceHandler must correctly encode script literals.

jrossstocholm · Apr 18, 2011 · ce3b0b7 · ce3b0b7
1 parent a9777b3
commit ce3b0b7
Showing 1 changed file with 38 additions and 6 deletions.
diff --git a/mcs/class/System.Web.Extensions/System.Web.Handlers/ScriptResourceHandler.cs b/mcs/class/System.Web.Extensions/System.Web.Handlers/ScriptResourceHandler.cs
@@ -51,12 +51,44 @@ public partial class ScriptResourceHandler : IHttpHandler
 
 		#endregion
 
-		// TODO: optimize
-		static string GetScriptStringLiteral (string value) {
-			string s = value;
-			s = s.Replace ("\\", "\\\\");
-			s = s.Replace ("\"", "\\\"");
-			return "\"" + s + "\"";
+		// TODO: add value cache?
+		static string GetScriptStringLiteral (string value)
+		{
+			if (String.IsNullOrEmpty (value))
+				return "\"" + value + "\"";
+
+			var sb = new StringBuilder ("\"");
+			for (int i = 0; i < value.Length; i++) {
+				char ch = value [i];
+				switch (ch) {
+					case '\'':
+						sb.Append ("\\u0027");
+						break;
+
+					case '"':
+						sb.Append ("\\\"");
+						break;
+
+					case '\\':
+						sb.Append ("\\\\");
+						break;
+
+					case '\n':
+						sb.Append ("\\n");
+						break;
+
+					case '\r':
+						sb.Append ("\\r");
+						break;
+
+					default:
+						sb.Append (ch);
+						break;
+				}
+			}
+			sb.Append ("\"");
+
+			return sb.ToString ();
 		}
 
 		class ResourceKey