Browse Source

Escape any custom CSS to avoid problems with quotes or newlines

Rich 7 years ago
parent
commit
f24db13426
2 changed files with 6 additions and 2 deletions
  1. 3
    1
      autoHeightWebView/index.android.js
  2. 3
    1
      autoHeightWebView/index.ios.js

+ 3
- 1
autoHeightWebView/index.android.js View File

240
     if (!styles) {
240
     if (!styles) {
241
       return script;
241
       return script;
242
     }
242
     }
243
+    // Escape any single quotes or newlines in the CSS with .replace()
244
+    const escaped = styles.replace(/\'/g, "\\'").replace(/\n/g, '\\n')
243
     return `
245
     return `
244
       var styleElement = document.createElement('style');
246
       var styleElement = document.createElement('style');
245
-      var styleText = document.createTextNode('${styles}');
247
+      var styleText = document.createTextNode('${escaped}');
246
       styleElement.appendChild(styleText);
248
       styleElement.appendChild(styleText);
247
       document.head.appendChild(styleElement);
249
       document.head.appendChild(styleElement);
248
       ${script}
250
       ${script}

+ 3
- 1
autoHeightWebView/index.ios.js View File

94
       if (!styles) {
94
       if (!styles) {
95
         return script;
95
         return script;
96
       }
96
       }
97
+      // Escape any single quotes or newlines in the CSS with .replace()
98
+      const escaped = styles.replace(/\'/g, "\\'").replace(/\n/g, '\\n')
97
       return `
99
       return `
98
         var styleElement = document.createElement('style');
100
         var styleElement = document.createElement('style');
99
-        var styleText = document.createTextNode('${styles}');
101
+        var styleText = document.createTextNode('${escaped}');
100
         styleElement.appendChild(styleText);
102
         styleElement.appendChild(styleText);
101
         document.head.appendChild(styleElement);
103
         document.head.appendChild(styleElement);
102
         ${script}
104
         ${script}