Escape = in HTML content

There was a potential XSS exploit when using unquoted attributes that this should help reduce. Fixes #1083
2015-09-01 01:44:35 -05:00
parent b0d217e13d
commit 83b8e846a3
2 changed files with 5 additions and 3 deletions
@@ -4,11 +4,12 @@ const escape = {
  '>': '&gt;',
  '"': '&quot;',
  "'": '&#x27;',
-  '`': '&#x60;'
+  '`': '&#x60;',
+  '=': '&#x3D;'
 };

-const badChars = /[&<>"'`]/g,
-      possible = /[&<>"'`]/;
+const badChars = /[&<>"'`=]/g,
+      possible = /[&<>"'`=]/;

 function escapeChar(chr) {
  return escape[chr];