fix: prevent signs like "<" or ">" to be treated as HTML in scripts

remy · Jul 28, 2015 · 4e7acd3 · 4e7acd3
1 parent 593a274
commit 4e7acd3
Show file tree

Hide file tree

Showing 5 changed files with 15 additions and 5 deletions.
diff --git a/lib/index.js b/lib/index.js
@@ -239,7 +239,7 @@ function main() {
         return promise.then(inliner.uglify.bind(inliner))
           .then(function then(res) {
           debug('uglify: %s', res);
-          $script.html(res);
+          $script.text(res);
         });
       });
 

diff --git a/test/fixtures/script-inline.result.html b/test/fixtures/script-inline.result.html
@@ -1 +1 @@
-<!DOCTYPE html> <html> <head> <meta charset="utf-8"> <title>inline script</title> </head> <body> <script>function doit(o){var r="remy",e=o.bar="sharp";return r+e.split("").reverse().join("")}console.log(doit(window));</script> <script>console.log("Hello world");</script> </body> </html>
+<!DOCTYPE html> <html> <head> <meta charset="utf-8"> <title>inline script</title> </head> <body> <script>function doit(o){var r="remy",e=o.bar="sharp";return r+e.split("").reverse().join("")}console.log(doit(window));</script> <script>for(var array=[4,8,15,16,23,42],i=0;i<array.length;i++)console.log(array[i]);</script> </body> </html>
diff --git a/test/fixtures/script-inline.src.html b/test/fixtures/script-inline.src.html
@@ -13,6 +13,12 @@
 
 console.log(doit(window));
 </script>
-<script>console.log('Hello world');</script>
+<script>
+  var array = [4, 8, 15, 16, 23, 42];
+
+  for (var i = 0; i < array.length; i++) {
+    console.log(array[i]);
+  }
+</script>
 </body>
 </html>
diff --git a/test/fixtures/script-local.js b/test/fixtures/script-local.js
@@ -1 +1,5 @@
-console.log('Hello world');
+var array = [4, 8, 15, 16, 23, 42];
+
+for (var i = 0; i < array.length; i++) {
+    console.log(array[i]);
+}
diff --git a/test/fixtures/script-local.result.html b/test/fixtures/script-local.result.html
@@ -1 +1 @@
-<!DOCTYPE html> <html> <head> <meta charset="utf-8"> <title>min script</title> </head> <body> <script>console.log("Hello world");</script> </body> </html>
+<!DOCTYPE html> <html> <head> <meta charset="utf-8"> <title>min script</title> </head> <body> <script>for(var array=[4,8,15,16,23,42],i=0;i<array.length;i++)console.log(array[i]);</script> </body> </html>
Original file line number	Diff line number	Diff line change
		@@ -1 +1 @@
		<!DOCTYPE html> <html> <head> <meta charset="utf-8"> <title>inline script</title> </head> <body> <script>function doit(o){var r="remy",e=o.bar="sharp";return r+e.split("").reverse().join("")}console.log(doit(window));</script> <script>console.log("Hello world");</script> </body> </html>
		<!DOCTYPE html> <html> <head> <meta charset="utf-8"> <title>inline script</title> </head> <body> <script>function doit(o){var r="remy",e=o.bar="sharp";return r+e.split("").reverse().join("")}console.log(doit(window));</script> <script>for(var array=[4,8,15,16,23,42],i=0;i<array.length;i++)console.log(array[i]);</script> </body> </html>