fix: escape html to get tooltip text (#167)

frappe · Jan 25, 2023 · 6c79a19 · 6c79a19
1 parent f990c1f
commit 6c79a19
Show file tree

Hide file tree

Showing 2 changed files with 19 additions and 2 deletions.
diff --git a/src/cellmanager.js b/src/cellmanager.js
@@ -2,7 +2,8 @@ import {
     copyTextToClipboard,
     makeDataAttributeString,
     throttle,
-    linkProperties
+    linkProperties,
+    escapeHTML,
 } from './utils';
 import $ from './dom';
 import icons from './icons';
@@ -886,7 +887,7 @@ export default class CellManager {
         let textContent = div.textContent;
         textContent = textContent.replace(/\s+/g, ' ').trim();
 
-        cellContentHTML = cellContentHTML.replace('>', ` title="${textContent}">`);
+        cellContentHTML = cellContentHTML.replace('>', ` title="${escapeHTML(textContent)}">`);
 
         return cellContentHTML;
     }

diff --git a/src/utils.js b/src/utils.js
@@ -149,3 +149,19 @@ export function format(str, args) {
 
     return str;
 };
+
+export function escapeHTML(txt) {
+    if (!txt) return '';
+    let escapeHtmlMapping = {
+        '&': '&amp;',
+        '<': '&lt;',
+        '>': '&gt;',
+        '"': '&quot;',
+        "'": '&#39;',
+        '/': '&#x2F;',
+        '`': '&#x60;',
+        '=': '&#x3D;',
+    };
+
+    return String(txt).replace(/[&<>"'`=/]/g, (char) => escapeHtmlMapping[char] || char);
+};