Escape JS string for URLs

Thanks c't
stefanw · Jan 27, 2024 · 3505f3e · 3505f3e
1 parent 7ecb1d0
commit 3505f3e
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 4 deletions.
diff --git a/src/tabrunner.ts b/src/tabrunner.ts
@@ -3,7 +3,7 @@ import { Action, Actions } from './types.js'
 
 import { STATUS_MESSAGE } from './const.js'
 import converters from './converters.js'
-import { makeTimeout } from './utils.js'
+import { escapeJsString, makeTimeout } from './utils.js'
 
 class TabRunner {
  tabId: number
@@ -84,7 +84,7 @@ class TabRunner {
  return [`document.querySelector('${action.click}').click()`]
  }
  } else if ('url' in action) {
- return [`document.location.href = '${action.url}';`]
+ return [`document.location.href = '${escapeJsString(action.url)}';`]
  } else if ('href' in action) {
  return [`document.location.href = document.querySelector('${action.href}').href;`]
  } else if ('captcha' in action) {

diff --git a/src/utils.ts b/src/utils.ts
@@ -23,7 +23,10 @@ function makeTimeout (ms: number) {
  }
 }
 
+const escapeJsString = (str) => {
+ return str.replace(/\\/g, '\\\\').replace(/'/g, '\\\'')
+}
+
 export {
- interpolate,
- makeTimeout
+ escapeJsString, interpolate, makeTimeout
 }