diff --git a/org.springframework.web/src/main/java/org/springframework/web/util/JavaScriptUtils.java b/org.springframework.web/src/main/java/org/springframework/web/util/JavaScriptUtils.java index b28d398687..861b46fe55 100644 --- a/org.springframework.web/src/main/java/org/springframework/web/util/JavaScriptUtils.java +++ b/org.springframework.web/src/main/java/org/springframework/web/util/JavaScriptUtils.java @@ -1,5 +1,5 @@ /* - * Copyright 2002-2008 the original author or authors. + * Copyright 2002-2013 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -21,21 +21,21 @@ package org.springframework.web.util; * Escapes based on the JavaScript 1.5 recommendation. * *
Reference: - * - * Core JavaScript 1.5 Guide - * + * + * JavaScript Guide on Mozilla Developer Network. * * @author Juergen Hoeller * @author Rob Harrop + * @author Rossen Stoyanchev * @since 1.1.1 */ public class JavaScriptUtils { /** - * Turn special characters into escaped characters conforming to JavaScript. - * Handles complete character set defined in HTML 4.01 recommendation. + * Turn JavaScript special characters into escaped characters. + * * @param input the input string - * @return the escaped string + * @return the string with escaped characters */ public static String javaScriptEscape(String input) { if (input == null) { @@ -73,6 +73,27 @@ public class JavaScriptUtils { else if (c == '\f') { filtered.append("\\f"); } + else if (c == '\b') { + filtered.append("\\b"); + } + // No '\v' in Java, use octal value for VT ascii char + else if (c == '\013') { + filtered.append("\\v"); + } + else if (c == '<') { + filtered.append("\\u003C"); + } + else if (c == '>') { + filtered.append("\\u003E"); + } + // Unicode for PS (line terminator in ECMA-262) + else if (c == '\u2028') { + filtered.append("\\u2028"); + } + // Unicode for LS (line terminator in ECMA-262) + else if (c == '\u2029') { + filtered.append("\\u2029"); + } else { filtered.append(c); } diff --git a/org.springframework.web/src/test/java/org/springframework/web/util/JavaScriptUtilsTests.java b/org.springframework.web/src/test/java/org/springframework/web/util/JavaScriptUtilsTests.java new file mode 100644 index 0000000000..182f18eb2d --- /dev/null +++ b/org.springframework.web/src/test/java/org/springframework/web/util/JavaScriptUtilsTests.java @@ -0,0 +1,67 @@ +/* + * Copyright 2004-2013 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.springframework.web.util; + +import static org.junit.Assert.*; + +import java.io.UnsupportedEncodingException; + +import org.junit.Test; + +/** + * Test fixture for {@link JavaScriptUtils}. + * + * @author Rossen Stoyanchev + */ +public class JavaScriptUtilsTests { + + @Test + public void escape() { + StringBuilder sb = new StringBuilder(); + sb.append('"'); + sb.append("'"); + sb.append("\\"); + sb.append("/"); + sb.append("\t"); + sb.append("\n"); + sb.append("\r"); + sb.append("\f"); + sb.append("\b"); + sb.append("\013"); + assertEquals("\\\"\\'\\\\\\/\\t\\n\\n\\f\\b\\v", JavaScriptUtils.javaScriptEscape(sb.toString())); + } + + // SPR-9983 + + @Test + public void escapePsLsLineTerminators() { + StringBuilder sb = new StringBuilder(); + sb.append('\u2028'); + sb.append('\u2029'); + String result = JavaScriptUtils.javaScriptEscape(sb.toString()); + + assertEquals("\\u2028\\u2029", result); + } + + // SPR-9983 + + @Test + public void escapeLessThanGreaterThanSigns() throws UnsupportedEncodingException { + assertEquals("\\u003C\\u003E", JavaScriptUtils.javaScriptEscape("<>")); + } + +}