Don't double-escape style names
Previously we were escaping both in createMarkupForStyles and then in createMarkupForProperty; now we escape only in the latter (otherwise the hypothetical style name `b&ckground` would become `b&ckground`). Test Plan: grunt fasttest
Ben Alpert committed
Apr 29, 2014 at 15:48 UTC
da342091483540da424f23bad146ed5d2f4bafb9
2 files changed
+8
-2
src/browser/ui/__tests__/ReactDOMComponent-test.js
+6
@@ -252,6 +252,12 @@ describe('ReactDOMComponent', function() {
252
expect(genMarkup({ className: 'a b' })).toHaveAttribute('class', 'a b');
253
expect(genMarkup({ className: '' })).toHaveAttribute('class', '');
254
});
255
+
256
+ it("should escape style names and values", function() {
257
+ expect(genMarkup({
258
+ style: {'b&ckground': '<3'}
259
+ })).toHaveAttribute('style', 'b&ckground:<3;');
260
+ });
261
});
262
263
describe('createContentMarkup', function() {
src/browser/ui/dom/CSSPropertyOperations.js
+2
-2
@@ -22,12 +22,11 @@
22
var CSSProperty = require('CSSProperty');
23
24
var dangerousStyleValue = require('dangerousStyleValue');
25
-var escapeTextForBrowser = require('escapeTextForBrowser');
25
var hyphenateStyleName = require('hyphenateStyleName');
26
var memoizeStringOnly = require('memoizeStringOnly');
27
28
var processStyleName = memoizeStringOnly(function(styleName) {
30
- return escapeTextForBrowser(hyphenateStyleName(styleName));
29
+ return hyphenateStyleName(styleName);
30
});
31
32
/**
@@ -42,6 +41,7 @@ var CSSPropertyOperations = {
41
* "width:200px;height:0;"
42
*
43
* Undefined values are ignored so that declarative programming is easier.
44
+ * The result should be HTML-escaped before insertion into the DOM.
45
*
46
* @param {object} styles
47
* @return {?string}