Escape html put into the highlighter

ivirabyan · Feb 16, 2015 · 0557c7b · 0557c7b
1 parent 0b4b714
commit 0557c7b
Show file tree

Hide file tree

Showing 2 changed files with 31 additions and 3 deletions.
diff --git a/jquery.mentions.coffee b/jquery.mentions.coffee
@@ -11,6 +11,19 @@ Selection =
             input[0].selectStart = start
             input[0].selectionEnd = end
 
+entityMap =
+    "&": "&amp;"
+    "<": "&lt;"
+    ">": "&gt;"
+    "\"": "&quot;"
+    "'": "&#39;"
+    "/": "&#x2F;"
+
+
+escapeHtml = (text) ->
+    text.replace /[&<>"'\/]/g, (s) ->
+        entityMap[s]
+
 
 settings =
     delay: 0
@@ -293,7 +306,7 @@ class MentionsInput extends MentionsBase
         @_addMention(name: ui.item.value, pos: ui.item.pos, uid: ui.item.uid)
 
     _updateValue: =>
-        value = hlContent = @input.val()
+        value = hlContent = escapeHtml(@input.val())
         for mention in @mentions
             markedName = @_mark(mention.name)
             hlContent = hlContent.replace(markedName, "<strong>#{mention.name}</strong>")

diff --git a/jquery.mentions.js b/jquery.mentions.js