浏览代码

LibWebView: Escape HTML within attribute values in the Inspector HTML

If an attribute value contains HTML, let's make sure we render it as
text, instead of injecting HTML in the middle of an Inspector field.
Timothy Flynn 1 年之前
父节点
当前提交
338f0382d3
共有 1 个文件被更改,包括 1 次插入1 次删除
  1. 1 1
      Userland/Libraries/LibWebView/InspectorClient.cpp

+ 1 - 1
Userland/Libraries/LibWebView/InspectorClient.cpp

@@ -542,7 +542,7 @@ String InspectorClient::generate_dom_tree(JsonObject const& dom_tree)
                 builder.appendff("<span data-node-type=\"attribute\" data-tag=\"{}\" data-attribute-index={} class=\"editable\">", tag, dom_node_attributes.size());
                 builder.appendff("<span class=\"attribute-name\">{}</span>", name);
                 builder.append('=');
-                builder.appendff("<span class=\"attribute-value\">\"{}\"</span>", value_string);
+                builder.appendff("<span class=\"attribute-value\">\"{}\"</span>", escape_html_entities(value_string));
                 builder.append("</span>"sv);
 
                 dom_node_attributes.empend(MUST(String::from_byte_string(name)), MUST(String::from_byte_string(value_string)));