Fix unescaped attr value in generated CSS selector

gorhill · gorhill · commit e9abce61a0d9 · 2019-12-31T16:14:50.000-05:00
Related feedback: - NanoAdblocker/NanoCore2@5e625da8fe45#commitcomment-36625096
diff --git a/src/js/contentscript.js b/src/js/contentscript.js
@@ -952,7 +952,7 @@ vAPI.domCollapser = (function() {
             if ( netSelectorCacheCount <= netSelectorCacheCountMax ) {
                 const value = target.getAttribute(prop);
                 if ( value ) {
-                    selectors.push(tag + '[' + prop + '="' + value + '"]');
+                    selectors.push(`${tag}[${prop}="${CSS.escape(value)}"]`);
                     netSelectorCacheCount += 1;
                 }
             }

Original file line number	Diff line number	Diff line change
`@@ -952,7 +952,7 @@ vAPI.domCollapser = (function() {`
`952`	`952`	`if ( netSelectorCacheCount <= netSelectorCacheCountMax ) {`
`953`	`953`	`const value = target.getAttribute(prop);`
`954`	`954`	`if ( value ) {`
`955`		`- selectors.push(tag + '[' + prop + '="' + value + '"]');`
	`955`	+ selectors.push(`${tag}[${prop}="${CSS.escape(value)}"]`);
`956`	`956`	`netSelectorCacheCount += 1;`
`957`	`957`	`}`
`958`	`958`	`}`