Escape single quotes when escaping text for HTML inclusion

Like double quote, its safer to escape single quotes too, in case
they are being used to wrap an attribute value and the returned
string is being included inside of the attribute value.

Signed-off-by: Shawn O. Pearce <sop@google.com>

1 files changed, 10 insertions, 1 deletions

diff --git a/src/main/java/com/google/gerrit/client/ui/DomUtil.java b/src/main/java/com/google/gerrit/client/ui/DomUtil.java
index c8034e196e..56e147c250 100644
--- a/src/main/java/com/google/gerrit/client/ui/DomUtil.java
+++ b/src/main/java/com/google/gerrit/client/ui/DomUtil.java
@@ -64,7 +64,13 @@ public abstract class DomUtil {
 
   private static class ClientImpl extends Impl {
     @Override
-    native String escape(String src)/*-{ return src.replace(/&/g,'&amp;').replace(/>/g,'&gt;').replace(/</g,'&lt;').replace(/"/g,'&quot;'); }-*/;
+    native String escape(String src)
+    /*-{ return src.replace(/&/g,'&amp;')
+                   .replace(/>/g,'&gt;')
+                   .replace(/</g,'&lt;')
+                   .replace(/"/g,'&quot;')
+                   .replace(/'/g,'&#39;')
+                   ; }-*/;
   }
 
   private static class JavaImpl extends Impl {
@@ -86,6 +92,9 @@ public abstract class DomUtil {
           case '"':
             r.append("&quot;");
             break;
+          case '\'':
+            r.append("&#39;");
+            break;
           default:
             r.append(c);
         }