From d1191adce65b1f498e4f37b95873df6ec3798aff Mon Sep 17 00:00:00 2001 From: Davy Duperron Date: Sat, 8 Apr 2017 16:55:50 +0200 Subject: [PATCH] Fix ampersand in jsx href and src (#1056) * Add exceptions for html escape usage in href and src attributes. * Add new test cases. * Remove useless spaces. * Do not escape if the parser does not do so. * Implement a different heuristic for keeping along with the parser. * Update tests. * Forgot passing options as param. * Experimental alternative implementation. * Remove other function. * Push test after merge. * Update getJsXRawValue in order to return the unprocessed raw value. Latest Babylon version includes a fix that allow us to directly inject the unprocessed raw value available in the `extra.rawValue` property of the node. A last transformation is applied by replacing double quotes to `"` entities. * Drop unused htmlEscapeInsideDoubleQuote function. * Move getJSXRawValue function logic to the its only call, drop it. A simple check is performed to determine if the parser is babylon or flow via `n.value.extra`. Thus, the corresponding raw value is extracted. If we are converting a string from single quotes to double quotes, we need to make sure that double quotes are converted to ". * Remove ambiguous comment. * Add Babylon parser. * Update test cases accordingly, revert regression introduced previously. --- src/printer.js | 5 ++++- src/util.js | 11 ----------- tests/jsx/__snapshots__/jsfmt.spec.js.snap | 15 +++++++++++++-- tests/jsx/html_escape.js | 3 +++ tests/jsx/jsfmt.spec.js | 2 +- tests/jsx/parens.js | 2 +- 6 files changed, 22 insertions(+), 16 deletions(-) create mode 100644 tests/jsx/html_escape.js diff --git a/src/printer.js b/src/printer.js index 93a307730..4d0b22b14 100644 --- a/src/printer.js +++ b/src/printer.js @@ -1200,7 +1200,10 @@ function genericPrintNoParens(path, options, print) { (n.value.type === "StringLiteral" || n.value.type === "Literal") && typeof n.value.value === "string" ) { - res = '"' + util.htmlEscapeInsideDoubleQuote(n.value.value) + '"'; + const value = n.value.extra ? n.value.extra.raw : n.value.raw; + res = '"' + + value.slice(1, value.length - 1).replace(/"/g, """) + + '"'; } else { res = path.call(print, "value"); } diff --git a/src/util.js b/src/util.js index ecf786f1c..0b5f6a1b5 100644 --- a/src/util.js +++ b/src/util.js @@ -265,16 +265,6 @@ function setLocEnd(node, index) { } } -// http://stackoverflow.com/a/7124052 -function htmlEscapeInsideDoubleQuote(str) { - return str.replace(/&/g, "&").replace(/"/g, """); - // Intentionally disable the following since it is safe inside of a - // double quote context - // .replace(/'/g, ''') - // .replace(//g, '>'); -} - // http://stackoverflow.com/a/7124052 function htmlEscapeInsideAngleBracket(str) { return str.replace(//g, ">"); @@ -328,6 +318,5 @@ module.exports = { locEnd, setLocStart, setLocEnd, - htmlEscapeInsideDoubleQuote, htmlEscapeInsideAngleBracket }; diff --git a/tests/jsx/__snapshots__/jsfmt.spec.js.snap b/tests/jsx/__snapshots__/jsfmt.spec.js.snap index 317844174..defb942d6 100644 --- a/tests/jsx/__snapshots__/jsfmt.spec.js.snap +++ b/tests/jsx/__snapshots__/jsfmt.spec.js.snap @@ -139,6 +139,17 @@ exports[`expression.js 1`] = ` " `; +exports[`html_escape.js 1`] = ` +"export default () => ; + +() => ; +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +export default () => ; + +() => ; +" +`; + exports[`hug.js 1`] = ` "
{__DEV__ @@ -279,7 +290,7 @@ exports[`parens.js 1`] = ` , + />, ];
@@ -305,7 +316,7 @@ exports[`quotes.js 1`] = `