diff --git a/src/qweb/qweb.ts b/src/qweb/qweb.ts index 00b43fba..bf48c88a 100644 --- a/src/qweb/qweb.ts +++ b/src/qweb/qweb.ts @@ -174,6 +174,10 @@ function parseXML(xml: string): Document { return doc; } +function escapeQuotes(str: string): string { + return str.replace(/\'/g, "\\'"); +} + //------------------------------------------------------------------------------ // QWeb rendering engine //------------------------------------------------------------------------------ @@ -694,13 +698,13 @@ export class QWeb extends EventBus { if ((value = value.trim())) { let classDef = value .split(/\s+/) - .map(a => `'${a}':true`) + .map(a => `'${escapeQuotes(a)}':true`) .join(","); classObj = `_${ctx.generateID()}`; ctx.addLine(`let ${classObj} = {${classDef}};`); } } else { - ctx.addLine(`let _${attID} = '${value}';`); + ctx.addLine(`let _${attID} = '${escapeQuotes(value)}';`); if (!name.match(/^[a-zA-Z]+$/)) { // attribute contains 'non letters' => we want to quote it name = '"' + name + '"'; diff --git a/tests/qweb/__snapshots__/qweb.test.ts.snap b/tests/qweb/__snapshots__/qweb.test.ts.snap index 899a4397..256f4c22 100644 --- a/tests/qweb/__snapshots__/qweb.test.ts.snap +++ b/tests/qweb/__snapshots__/qweb.test.ts.snap @@ -923,6 +923,19 @@ exports[`static templates div with a class attribute 1`] = ` }" `; +exports[`static templates div with a class attribute with a quote 1`] = ` +"function anonymous(context, extra +) { + // Template name: \\"test\\" + let h = this.h; + let _2 = {'a\\\\'bc':true}; + let c3 = [], p3 = {key:3,class:_2}; + let vn3 = h('div', p3, c3); + c3.push({text: \`word\`}); + return vn3; +}" +`; + exports[`static templates div with a empty class attribute 1`] = ` "function anonymous(context, extra ) { @@ -962,6 +975,19 @@ exports[`static templates div with a text node 1`] = ` }" `; +exports[`static templates div with an arbitrary attribute with a quote 1`] = ` +"function anonymous(context, extra +) { + // Template name: \\"test\\" + let h = this.h; + let _1 = 'a\\\\'bc'; + let c2 = [], p2 = {key:2,attrs:{abc: _1}}; + let vn2 = h('div', p2, c2); + c2.push({text: \`word\`}); + return vn2; +}" +`; + exports[`static templates empty div 1`] = ` "function anonymous(context, extra ) { diff --git a/tests/qweb/qweb.test.ts b/tests/qweb/qweb.test.ts index a98b3a1f..ea9ea246 100644 --- a/tests/qweb/qweb.test.ts +++ b/tests/qweb/qweb.test.ts @@ -51,6 +51,16 @@ describe("static templates", () => { expect(renderToString(qweb, "test")).toBe(`
word
`); }); + test("div with a class attribute with a quote", () => { + qweb.addTemplate("test", `
word
`); + expect(renderToString(qweb, "test")).toBe(`
word
`); + }); + + test("div with an arbitrary attribute with a quote", () => { + qweb.addTemplate("test", `
word
`); + expect(renderToString(qweb, "test")).toBe(`
word
`); + }); + test("div with a empty class attribute", () => { qweb.addTemplate("test", `
word
`); expect(renderToString(qweb, "test")).toBe(`
word
`);