fix(coverage): escape source code in html coverage report (denoland#2…

…1531)
dsherret · Dec 11, 2023 · 073e341 · 073e341
1 parent e9ab9ba
commit 073e341
Show file tree

Hide file tree

Showing 3 changed files with 9 additions and 2 deletions.
diff --git a/cli/tests/integration/coverage_tests.rs b/cli/tests/integration/coverage_tests.rs
@@ -553,6 +553,8 @@ fn test_html_reporter() {
  let bar_ts_html =
  fs::read_to_string(tempdir.join("html").join("bar.ts.html")).unwrap();
  assert!(bar_ts_html.contains("<h1>Coverage report for bar.ts</h1>"));
+ // Check <T> in source code is escaped to &lt;T&gt;
+ assert!(bar_ts_html.contains("&lt;T&gt;"));
 
  let baz_index_html =
  fs::read_to_string(tempdir.join("html").join("baz").join("index.html"))

diff --git a/cli/tests/testdata/coverage/multisource/bar.ts b/cli/tests/testdata/coverage/multisource/bar.ts
@@ -1,4 +1,4 @@
-export function bar(cond: boolean) {
+export function bar<T>(cond: T) {
  if (cond) {
  return 1;
  } else {

diff --git a/cli/tools/coverage/reporter.rs b/cli/tools/coverage/reporter.rs
@@ -512,7 +512,7 @@ impl HtmlCoverageReporter {
  /// Creates <table> of single file code coverage.
  pub fn create_html_code_table(
  &self,
- file_text: &String,
+ file_text: &str,
  report: &CoverageReport,
  ) -> String {
  let line_num = file_text.lines().count();
@@ -548,6 +548,11 @@ impl HtmlCoverageReporter {
  .collect::<Vec<_>>()
  .join("\n");
 
+ let file_text = file_text
+ .replace('&', "&amp;")
+ .replace('<', "&lt;")
+ .replace('>', "&gt;");
+
  // TODO(kt3k): Add syntax highlight to source code
  format!(
  "<table class='coverage'>