Escape HTML in diffs.

Author: danlucraft

lib/git.js

@@ -52,7 +52,13 @@ Git = {
   // zlib files contain a two byte header. (RFC 1950)
   stripZlibHeader: function(zlib) {
     return zlib.slice(2)
-  }
+  },
 
+  escapeHTML: function(s) {
+    return s
+      .replace(/&/g, '&')
+      .replace(/</g, '&lt;')
+      .replace(/>/g, '&gt;');
+  }
 }
 

lib/git.min.js

@@ -3530,8 +3530,14 @@ Git = {
   // zlib files contain a two byte header. (RFC 1950)
   stripZlibHeader: function(zlib) {
     return zlib.slice(2)
-  }
+  },
 
+  escapeHTML: function(s) {
+    return s
+      .replace(/&/g, '&')
+      .replace(/</g, '&lt;')
+      .replace(/>/g, '&gt;');
+  }
 }
 
 
@@ -4788,16 +4794,18 @@ Git.Diff = function(file1, file2, options) {
     str.push("  <div class='diff'>")
     var diff = this
     _(this.info).each(function(chunk) {
-      // str.push("@ " + chunk.offset)
       _(chunk.lines).each(function(line) {
-        var truncatedLine = line.line.slice(0, Git.Diff.MAX_LINE_CHARS)
+        var truncatedLine = Git.escapeHTML(line.line.slice(0, Git.Diff.MAX_LINE_CHARS))
         if (line.type == "context") {
-          str.push("<pre class='context'>" + line.oldIndex.toString().rjust(2, " ") + " " + line.newIndex.toString().rjust(2, " ") + "  " + truncatedLine + "</pre>")
+          var oldIx = line.oldIndex.toString().rjust(2, " ")
+          var newIx = line.newIndex.toString().rjust(2, " ")
+          str.push("<pre class='context'>" + oldIx + " " + newIx + "  " + truncatedLine + "</pre>")
         } else if (line.type == "added") {
-          str.push("<pre class='added'>" + "   " + line.newIndex.toString().rjust(2, " ") + " +" + truncatedLine + "</pre>")
+          var newIx = line.newIndex.toString().rjust(2, " ")
+          str.push("<pre class='added'>" + "   " + newIx + " +" + truncatedLine + "</pre>")
         } else if (line.type == "removed") {
-          str.push("<pre class='removed'>" + line.oldIndex.toString().rjust(2, " ") + "    -" + truncatedLine + "</pre>")
-          
+          var oldIx = line.oldIndex.toString().rjust(2, " ")
+          str.push("<pre class='removed'>" + oldIx + "    -" + truncatedLine + "</pre>")
         }
       })
     })

lib/git/diff.js

@@ -98,16 +98,18 @@ Git.Diff = function(file1, file2, options) {
     str.push("  <div class='diff'>")
     var diff = this
     _(this.info).each(function(chunk) {
-      // str.push("@ " + chunk.offset)
       _(chunk.lines).each(function(line) {
-        var truncatedLine = line.line.slice(0, Git.Diff.MAX_LINE_CHARS)
+        var truncatedLine = Git.escapeHTML(line.line.slice(0, Git.Diff.MAX_LINE_CHARS))
         if (line.type == "context") {
-          str.push("<pre class='context'>" + line.oldIndex.toString().rjust(2, " ") + " " + line.newIndex.toString().rjust(2, " ") + "  " + truncatedLine + "</pre>")
+          var oldIx = line.oldIndex.toString().rjust(2, " ")
+          var newIx = line.newIndex.toString().rjust(2, " ")
+          str.push("<pre class='context'>" + oldIx + " " + newIx + "  " + truncatedLine + "</pre>")
         } else if (line.type == "added") {
-          str.push("<pre class='added'>" + "   " + line.newIndex.toString().rjust(2, " ") + " +" + truncatedLine + "</pre>")
+          var newIx = line.newIndex.toString().rjust(2, " ")
+          str.push("<pre class='added'>" + "   " + newIx + " +" + truncatedLine + "</pre>")
         } else if (line.type == "removed") {
-          str.push("<pre class='removed'>" + line.oldIndex.toString().rjust(2, " ") + "    -" + truncatedLine + "</pre>")
-          
+          var oldIx = line.oldIndex.toString().rjust(2, " ")
+          str.push("<pre class='removed'>" + oldIx + "    -" + truncatedLine + "</pre>")
         }
       })
     })