@@ -93,26 +93,21 @@ function JSON.lower(n::Node)
9393 " type" => " node" ,
9494 " nodeType" => nodetype (n),
9595 " instanceArgs" => JSON. lower (n. instanceof),
96- " children" => map! (renderPreferScopeJSON ,
96+ " children" => map! (render_internal ,
9797 Vector {Any} (undef, length (children (n))),
9898 children (n)),
9999 " props" => props (n),
100100 )
101101 return result
102102end
103103
104- # # TODO -- optimize
105- function escapeHTML (i:: String )
106- # Refer to http://stackoverflow.com/a/7382028/3822752 for spec. links
107- o = replace (i, " &" => " &" )
108- o = replace (o, " \" " => " "" )
109- o = replace (o, " '" => " '" )
110- o = replace (o, " <" => " <" )
111- o = replace (o, " >" => " >" )
112- return o
113- end
114-
115- function escapeJSONForScriptTag (s:: String )
104+ """
105+ Escape characters for a "safe" representation of JSON.
106+ In particular, we escape '/' characters to avoid the presence of "</" (and
107+ especially "</script>") which cause the browser to break out of the current
108+ <script /> tag.
109+ """
110+ function escape_json (s:: String )
116111 # Replace all "/" with "\/"'s.
117112 # This prevents the browser from interpreting "</" as a close tag; since
118113 # everything within the string is JSON, any appearances of "/" should be
@@ -121,24 +116,17 @@ function escapeJSONForScriptTag(s::String)
121116 return replace (s, " /" => " \\ /" )
122117end
123118
119+ escape_json (x:: Any ) = escape_json (JSON. json (x))
120+
124121function Base. show (io:: IO , m:: MIME"text/html" , x:: Node )
125- # write(io, "<div class='display:none'></div>" *
126- # """<unsafe-script style='display:none'>
127- # WebIO.mount(this.previousSibling,""")
128- # # NOTE: do NOT add space between </div> and <unsafe-script>
129- # write(io, sprint(s->jsexpr(s, x)))
130- # write(io, ")</unsafe-script>")
131- println (" === Base.show(::IO, text/html, ::Node)" )
132- println (" === Base.show: Node: $x " )
133122 jsrepr = jsexpr (x)
134- println (" ===jsexpr(Node): $jsrepr " )
135123 write (
136124 io,
137125 """
138126 <div class=\" webio-connected\" ><script defer>
139127 WebIO.mount(
140128 document.currentScript.parentElement,
141- $(escapeJSONForScriptTag (JSON . json (x) )) ,
129+ $(escape_json (x )) ,
142130 )
143131 </script></div>
144132 """
0 commit comments