From 29379d95dee7886c804cc695a710bbb4f08c1be6 Mon Sep 17 00:00:00 2001
From: =?utf8?q?Sven=20Sch=C3=B6ling?= <s.schoeling@linet-services.de>
Date: Mon, 15 Jul 2013 18:44:22 +0200
Subject: [PATCH] Javascript escape nach Ecmascript Spec.
MIME-Version: 1.0
Content-Type: text/plain; charset=utf8
Content-Transfer-Encoding: 8bit

Es gab einen Eckfall mit CR wo das kaputt gegangen ist, Spec kennt
noch als weitere Randfälle TAB, VT, ' und BS
---
 SL/Template/Plugin/JavaScript.pm | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/SL/Template/Plugin/JavaScript.pm b/SL/Template/Plugin/JavaScript.pm
index 241ea0ea3..16989e9a2 100644
--- a/SL/Template/Plugin/JavaScript.pm
+++ b/SL/Template/Plugin/JavaScript.pm
@@ -17,13 +17,23 @@ sub new {
 # public interface
 #
 
+# see ecmascript spec section 7.8.4
+my @escape_chars = ('\\', '\'', '"');
+my %control_chars = (
+  "\n"   => 'n',
+  "\t"   => 't',
+  "\r"   => 'r',
+  "\f"   => 'f',
+  "\x08" => 'b',
+  "\x0B" => 'v', # noone uses vertical tab anyway...
+);
+my $re = join '', map { qr/($_)/s } join '|', keys(%control_chars), map { "\Q$_\E" } @escape_chars;
+
 sub escape {
   my $self = shift;
   my $text = shift;
 
-  $text =~ s|\\|\\\\|g;
-  $text =~ s|\"|\\\"|g;
-  $text =~ s|\n|\\n|g;
+  $text =~ s/$re/'\\' . ($control_chars{$1} || $1)/egs;
 
   return $text;
 }
-- 
2.20.1