fix: add JS escaping in sync output

isc-tleavitt · isc-tleavitt · commit 0bd96de98fa0 · 2024-09-12T16:41:09.000-04:00
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -17,6 +17,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Instance wide settings are placed in proper global (#444)
 - Added support to switch branch in basic mode from menu (#451)
 - Avoid delay/errors in loading interop JS when there is a URL prefix (e.g., instance name in multi-instance webserver configuration)
+- Added proper JS escaping in sync output
 
 ## [2.4.1] - 2024-08-02
 
diff --git a/csp/sync.csp b/csp/sync.csp
@@ -146,7 +146,7 @@
 
             &js<
                 var outputContainer = document.getElementById('outputBox');
-                var lineText = "#(escapedLine)#";
+                var lineText = "#(..QuoteJS(escapedLine))#";
                 var lineTextNode = document.createTextNode(lineText);
                 outputContainer.innerHTML += lineText + "<br>";
             >

Original file line number	Diff line number	Diff line change
`@@ -146,7 +146,7 @@`
`146`	`146`
`147`	`147`	`&js<`
`148`	`148`	`var outputContainer = document.getElementById('outputBox');`
`149`		`- var lineText = "#(escapedLine)#";`
	`149`	`+ var lineText = "#(..QuoteJS(escapedLine))#";`
`150`	`150`	`var lineTextNode = document.createTextNode(lineText);`
`151`	`151`	`outputContainer.innerHTML += lineText + "<br>";`
`152`	`152`	`>`