bug(locators): escape query in byExactBinding

See http://stackoverflow.com/q/3561711 Closes #1918
angular · May 18, 2015 · 3cded9b · 3cded9b · juliemr · May 20, 2015
1 parent de49969
commit 3cded9b
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 2 deletions.
diff --git a/lib/clientsidescripts.js b/lib/clientsidescripts.js
@@ -72,7 +72,10 @@ functions.findBindings = function(binding, exactMatch, using, rootSelector) {
     if (dataBinding) {
       var bindingName = dataBinding.exp || dataBinding[0].exp || dataBinding;
       if (exactMatch) {
-        var matcher = new RegExp('({|\\s|^|\\|)' + binding + '(}|\\s|$|\\|)');
+        var matcher = new RegExp('({|\\s|^|\\|)' +
+            /* See http://stackoverflow.com/q/3561711 */
+            binding.replace(/[\-\[\]\/\{\}\(\)\*\+\?\.\\\^\$\|]/g, "\\$&") +
+            '(}|\\s|$|\\|)');
         if (matcher.test(bindingName)) {
           matches.push(bindings[i]);
         }

diff --git a/website/docgen/inline_tags/code.js b/website/docgen/inline_tags/code.js
@@ -1,8 +1,20 @@
+var htmlSpecialCharMap = {
+  "&": "&amp;",
+  "<": "&lt;",
+  ">": "&gt;",
+  '"': '&quot;',
+  "'": '&#39;',
+  "/": '&#x2F;'
+};
+
 module.exports = function codeTagDef() {
   return {
     name: 'code',
     handler: function(doc, tag, content) {
-      return '<code ng-non-bindable>' + content + '</code>';
+      return '<code ng-non-bindable>' +
+          content.replace(/[&<>"'\/]/g, function (s) { 
+            return htmlSpecialCharMap[s];
+          }) + '</code>';
     },
     description: 'Handle inline code tags',
     aliases: ['monospace']