Merge branch 'rbelouin-escape'

snabbdom · Nov 20, 2017 · 9ac022c · 9ac022c
2 parents a291733 + f9b868c
commit 9ac022c
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 2 deletions.
diff --git a/init.js b/init.js
@@ -1,4 +1,5 @@
 
+var escape = require('lodash.escape')
 var parseSelector = require('parse-sel')
 var VOID_ELEMENTS = require('./elements').VOID
 var CONTAINER_ELEMENTS = require('./elements').CONTAINER
@@ -30,7 +31,7 @@ module.exports = function init (modules) {
     }
 
     if (!vnode.sel && vnode.text) {
-      return vnode.text
+      return escape(vnode.text)
     }
 
     vnode.data = vnode.data || {}
@@ -68,7 +69,7 @@ module.exports = function init (modules) {
       if (vnode.data.props && vnode.data.props.innerHTML) {
         tag.push(vnode.data.props.innerHTML)
       } else if (vnode.text) {
-        tag.push(vnode.text)
+        tag.push(escape(vnode.text))
       } else if (vnode.children) {
         vnode.children.forEach(function (child) {
           tag.push(renderToString(child))

diff --git a/test/index.js b/test/index.js
@@ -279,3 +279,15 @@ test('Custom CSS properties', function (t) {
 
   t.end()
 })
+
+test('Escape HTML in the text content', function (t) {
+  var vnode = h('div', ['<p></p>'])
+
+  t.equal(toHTML(vnode), '<div>&lt;p&gt;&lt;/p&gt;</div>')
+
+  vnode = h('div', '<p></p>')
+
+  t.equal(toHTML(vnode), '<div>&lt;p&gt;&lt;/p&gt;</div>')
+
+  t.end()
+})