Property escape file names in HTML

fixes #28

HISTORY.md

@@ -1,9 +1,11 @@
 unreleased
 ==========
 
+  * Property escape file names in HTML
   * deps: debug@~2.1.3
     - Fix high intensity foreground color for bold
     - deps: ms@0.7.0
+  * deps: escape-html@1.0.1
 
 1.6.2 / 2015-02-16
 ==================

index.js

@@ -2,7 +2,7 @@
  * serve-index
  * Copyright(c) 2011 Sencha Inc.
  * Copyright(c) 2011 TJ Holowaychuk
- * Copyright(c) 2014 Douglas Christopher Wilson
+ * Copyright(c) 2014-2015 Douglas Christopher Wilson
  * MIT Licensed
  */
 
@@ -11,11 +11,13 @@
 
 /**
  * Module dependencies.
+ * @private
  */
 
 var accepts = require('accepts');
 var createError = require('http-errors');
 var debug = require('debug')('serve-index');
+var escapeHtml = require('escape-html');
 var fs = require('fs')
   , path = require('path')
   , normalize = path.normalize
@@ -383,12 +385,11 @@ function html(files, dir, useIcons, view) {
 
     return '<li><a href="'
       + normalizeSlashes(normalize(path.join('/')))
-      + '" class="'
-      + classes.join(' ') + '"'
-      + ' title="' + file.name + '">'
-      + '<span class="name">'+file.name+'</span>'
-      + '<span class="size">'+size+'</span>'
-      + '<span class="date">'+date+'</span>'
+      + '" class="' + escapeHtml(classes.join(' ')) + '"'
+      + ' title="' + escapeHtml(file.name) + '">'
+      + '<span class="name">' + escapeHtml(file.name) + '</span>'
+      + '<span class="size">' + escapeHtml(size) + '</span>'
+      + '<span class="date">' + escapeHtml(date) + '</span>'
       + '</a></li>';
 
   }).join('\n') + '</ul>';

package.json

@@ -9,6 +9,7 @@
     "accepts": "~1.2.4",
     "batch": "0.5.2",
     "debug": "~2.1.3",
+    "escape-html": "1.0.1",
     "http-errors": "~1.3.1",
     "mime-types": "~2.0.9",
     "parseurl": "~1.3.0"

test/test.js

@@ -136,6 +136,20 @@ describe('serveIndex(root)', function () {
         .end(done);
       });
 
+      it('should property escape file names', function (done) {
+        var server = createServer()
+
+        request(server)
+        .get('/')
+        .set('Accept', 'text/html')
+        .expect(200)
+        .expect('Content-Type', 'text/html; charset=utf-8')
+        .expect(/<a href="\/foo%20%26%20bar"/)
+        .expect(/foo &amp; bar/)
+        .expect(/foo &(?! )/)
+        .end(done);
+      });
+
       it('should sort folders first', function (done) {
         var server = createServer()
 
@@ -154,7 +168,7 @@ describe('serveIndex(root)', function () {
             '/g%23%20%253%20o%20%252525%20%2537%20dir',
             '/users',
             '/file%20%231.txt',
-            '/foo%20bar',
+            '/foo%20%26%20bar',
             '/nums',
             '/todo.txt',
             '/%E3%81%95%E3%81%8F%E3%82%89.txt'