Escape & and < in span before inserting them into DOM

13 years ago · bbd34c7e7c
parent b6ccd8bf88
commit bbd34c7e7c
1 changed files with 2 additions and 0 deletions
--- a/app/assets/javascripts/player/terminal_view.js.coffee
+++ b/app/assets/javascripts/player/terminal_view.js.coffee
@ -46,6 +46,8 @@ class AsciiIo.TerminalView extends Backbone.View
      if d
        [char, brush] = d

+        char = char.replace('&', '&amp;').replace('<', '&lt;')
+
        if brush != prevBrush or i is cursorX or i is (cursorX + 1)
          if prevBrush
            html += '</span>'