Commit c43c469a authored by Vajrasky Kok's avatar Vajrasky Kok Committed by Tim Graham
Browse files

Fixed #21731 -- Made javascript_quote escapes '</'.

parent b17c7556

django/utils/text.py

+1 −0
Original line number Diff line number Diff line
@@ -327,6 +327,7 @@ def javascript_quote(s, quote_double_quotes=False): 
    s = s.replace('\n', '\\n')

    s = s.replace('\t', '\\t')

    s = s.replace("'", "\\'")

    s = s.replace('</', '<\\/')

    if quote_double_quotes:

        s = s.replace('"', '&quot;')

    return str(ustring_re.sub(fix, s))

tests/utils_tests/test_text.py

+11 −0
Original line number Diff line number Diff line
@@ -144,3 +144,14 @@ class TestUtilsText(SimpleTestCase): 
    def test_get_valid_filename(self):

        filename = "^&'@{}[],$=!-#()%+~_123.txt"

        self.assertEqual(text.get_valid_filename(filename), "-_123.txt")



    def test_javascript_quote(self):

        input = "<script>alert('Hello \\xff.\n Welcome\there\r');</script>"

        output = r"<script>alert(\'Hello \\xff.\n Welcome\there\r\');<\/script>"

        self.assertEqual(text.javascript_quote(input), output)



        # Exercising quote_double_quotes keyword argument

        input = '"Text"'

        self.assertEqual(text.javascript_quote(input), '"Text"')

        self.assertEqual(text.javascript_quote(input, quote_double_quotes=True),

                         '&quot;Text&quot;')