Jelajahi Sumber

LibWebView: Escape HTML within attribute values in the Inspector HTML

If an attribute value contains HTML, let's make sure we render it as
text, instead of injecting HTML in the middle of an Inspector field.
Timothy Flynn 1 tahun lalu
induk
melakukan
338f0382d3
1 mengubah file dengan 1 tambahan dan 1 penghapusan
  1. 1 1
      Userland/Libraries/LibWebView/InspectorClient.cpp

+ 1 - 1
Userland/Libraries/LibWebView/InspectorClient.cpp

@@ -542,7 +542,7 @@ String InspectorClient::generate_dom_tree(JsonObject const& dom_tree)
                 builder.appendff("<span data-node-type=\"attribute\" data-tag=\"{}\" data-attribute-index={} class=\"editable\">", tag, dom_node_attributes.size());
                 builder.appendff("<span data-node-type=\"attribute\" data-tag=\"{}\" data-attribute-index={} class=\"editable\">", tag, dom_node_attributes.size());
                 builder.appendff("<span class=\"attribute-name\">{}</span>", name);
                 builder.appendff("<span class=\"attribute-name\">{}</span>", name);
                 builder.append('=');
                 builder.append('=');
-                builder.appendff("<span class=\"attribute-value\">\"{}\"</span>", value_string);
+                builder.appendff("<span class=\"attribute-value\">\"{}\"</span>", escape_html_entities(value_string));
                 builder.append("</span>"sv);
                 builder.append("</span>"sv);
 
 
                 dom_node_attributes.empend(MUST(String::from_byte_string(name)), MUST(String::from_byte_string(value_string)));
                 dom_node_attributes.empend(MUST(String::from_byte_string(name)), MUST(String::from_byte_string(value_string)));