escape HTML output

larryng · May 15, 2012 · bde3bc0 · bde3bc0
1 parent 2c853dd
commit bde3bc0
Show file tree

Hide file tree

Showing 3 changed files with 17 additions and 6 deletions.
diff --git a/coffee/main.coffee b/coffee/main.coffee
@@ -17,6 +17,11 @@ require ['jquery', 'coffee-script', 'nodeutil'], ($, CoffeeScript, nodeutil) ->
     $inputr    = $('#inputr')
     $inputcopy = $('#inputcopy')
 
+
+    escapeHTML = (s) ->
+      s.replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;');
+
+
     class CoffeeREPL
       constructor: (@output, @input, @prompt, settings={}) ->
         @history = []
@@ -83,7 +88,7 @@ require ['jquery', 'coffee-script', 'nodeutil'], ($, CoffeeScript, nodeutil) ->
             e.preventDefault()
             input = @grabInput()
 
-            @print @prompt.html() + input
+            @print @prompt.html() + escapeHTML(input)
 
             if input
               @addToSaved input
@@ -97,7 +102,7 @@ require ['jquery', 'coffee-script', 'nodeutil'], ($, CoffeeScript, nodeutil) ->
             if input and @multiline and @saved
               input = @grabInput()
 
-              @print @prompt.html() + input
+              @print @prompt.html() + escapeHTML(input)
               @addToSaved input
               @processSaved()
             else if @multiline and @saved

diff --git a/js/main.js b/js/main.js
diff --git a/js/nodeutil.js b/js/nodeutil.js
@@ -263,6 +263,9 @@ define(
       return reduceToSingleString(output, base, braces);
     }
 
+    function escapeHTML (s) {
+      return s.replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;');
+    }
 
     function formatPrimitive(ctx, value) {
       switch (typeof value) {
@@ -273,7 +276,7 @@ define(
           var simple = '\'' + JSON.stringify(value).replace(/^"|"$/g, '')
                                                    .replace(/'/g, "\\'")
                                                    .replace(/\\"/g, '"') + '\'';
-          return ctx.stylize(simple, 'string');
+          return ctx.stylize(escapeHTML(simple), 'string');
 
         case 'number':
           return ctx.stylize('' + value, 'number');