Merge "Remove unnecessary HTML escaping"

polygerrit-ui/app/elements/diff/gr-diff-builder/gr-diff-builder.js

@@ -14,6 +14,17 @@
 (function(window, GrDiffGroup, GrDiffLine) {
   'use strict';
 
+  var HTML_ENTITY_PATTERN = /[&<>"'`\/]/g;
+  var HTML_ENTITY_MAP = {
+    '&': '&amp;',
+    '<': '&lt;',
+    '>': '&gt;',
+    '"': '&quot;',
+    '\'': '&#39;',
+    '/': '&#x2F;',
+    '`': '&#96;',
+  };
+
   // Prevent redefinition.
   if (window.GrDiffBuilder) { return; }
 
@@ -386,7 +397,7 @@
       td.classList.add('content');
     }
     td.classList.add(line.type);
-    var html = util.escapeHTML(text);
+    var html = this._escapeHTML(text);
     html = this._addTabWrappers(html, this._prefs.tab_size);
 
     if (!this._prefs.line_wrapping &&
@@ -577,5 +588,11 @@
         !(!group.adds.length && !group.removes.length);
   };
 
+  GrDiffBuilder.prototype._escapeHTML = function(str) {
+    return str.replace(HTML_ENTITY_PATTERN, function(s) {
+      return HTML_ENTITY_MAP[s];
+    });
+  };
+
   window.GrDiffBuilder = GrDiffBuilder;
 })(window, GrDiffGroup, GrDiffLine);

polygerrit-ui/app/elements/diff/gr-diff-builder/gr-diff-builder_test.html

@@ -949,6 +949,19 @@ limitations under the License.
           done();
         });
       });
+
+      test('_escapeHTML', function() {
+        var input = '<script>alert("XSS");<' + '/script>';
+        var expected = '&lt;script&gt;alert(&quot;XSS&quot;);' +
+            '&lt;&#x2F;script&gt;';
+        var result = GrDiffBuilder.prototype._escapeHTML(input);
+        assert.equal(result, expected);
+
+        input = '& < > " \' / `';
+        expected = '&amp; &lt; &gt; &quot; &#39; &#x2F; &#96;';
+        result = GrDiffBuilder.prototype._escapeHTML(input);
+        assert.equal(result, expected);
+      });
     });
   });
 </script>

polygerrit-ui/app/elements/shared/gr-account-label/gr-account-label.js

@@ -33,10 +33,10 @@
       if (!account || (!account.name && !account.email)) { return; }
       var result = '';
       if (account.name) {
-        result += util.escapeHTML(account.name);
+        result += account.name;
       }
       if (account.email) {
-        result += ' <' + util.escapeHTML(account.email) + '>';
+        result += ' <' + account.email + '>';
       }
       return result;
     },

polygerrit-ui/app/scripts/util.js

@@ -24,22 +24,6 @@
     return new Date(dateStr.replace(' ', 'T') + 'Z');
   };
 
-  util.htmlEntityMap = {
-    '&': '&',
-    '<': '&lt;',
-    '>': '&gt;',
-    '"': '&quot;',
-    '\'': '&#39;',
-    '/': '&#x2F;',
-    '`': '&#96;',
-  };
-
-  util.escapeHTML = function(str) {
-    return str.replace(/[&<>"'`\/]/g, function(s) {
-      return util.htmlEntityMap[s];
-    });
-  };
-
   util.getCookie = function(name) {
     var key = name + '=';
     var cookies = document.cookie.split(';');