Quote all needed XML chars. See #263.

Includes testcase.
mapbox · Mar 27, 2013 · d6585d3 · d6585d3
1 parent acf94e5
commit d6585d3
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 5 deletions.
diff --git a/lib/carto/tree/quoted.js b/lib/carto/tree/quoted.js
@@ -10,6 +10,9 @@ tree.Quoted.prototype = {
     toString: function(quotes) {
         var xmlvalue = this.value.replace(/&/g, '&amp;');
         xmlvalue = xmlvalue.replace(/\'/g, '&apos;');
+        xmlvalue = xmlvalue.replace(/\"/g, '&quot;');
+        xmlvalue = xmlvalue.replace(/\</g, '&lt;');
+        xmlvalue = xmlvalue.replace(/\>/g, '&gt;');
         return (quotes === true) ? "'" + xmlvalue + "'" : this.value;
     },
 

diff --git a/test/quoted.test.js b/test/quoted.test.js
@@ -5,19 +5,19 @@ require('../lib/carto/tree/quoted');
 describe('Quoted', function() {
     describe('basic functionality', function() {
         it('should be constructed', function() {
-            var f = new tree.Quoted("Tom's & quoted");
+            var f = new tree.Quoted("Tom's & \"<quoted>\"");
             assert.ok(f);
             assert.equal(f.is, 'string');
         });
         it('should produce normal output', function() {
-            var f = new tree.Quoted("Tom's & quoted");
+            var f = new tree.Quoted("Tom's & \"<quoted>\"");
             assert.ok(f);
-            assert.equal(f.toString(), "Tom's & quoted");
+            assert.equal(f.toString(), "Tom's & \"<quoted>\"");
         });
         it('should produce xml-friendly output', function() {
-            var f = new tree.Quoted("Tom's & quoted");
+            var f = new tree.Quoted("Tom's & \"<quoted>\"");
             assert.ok(f);
-            assert.equal(f.toString(true), "'Tom&apos;s &amp; quoted'");
+            assert.equal(f.toString(true), "'Tom&apos;s &amp; &quot;&lt;quoted&gt;&quot;'");
         });
     });
 });