terminal<\/span><\/div>/g) || []).length, 1, output);
});
+ it('basic terminal with html unsafe chars', async () => {
+ await writeP(terminal, ' ');
+ terminal.select(1, 0, 37);
+
+ const output = serializeAddon.serializeAsHTML({
+ onlySelection: true
+ });
+ assert.equal((output.match(/<script>alert("π = 3.14")<\/script><\/span><\/div>/g) || []).length, 1, output);
+ });
+
it('cells with bold styling', async () => {
await writeP(terminal, ' ' + sgr('1') + 'terminal' + sgr('22') + ' ');
diff --git a/addons/addon-serialize/src/SerializeAddon.ts b/addons/addon-serialize/src/SerializeAddon.ts
index e654eddb..0f87885f 100644
--- a/addons/addon-serialize/src/SerializeAddon.ts
+++ b/addons/addon-serialize/src/SerializeAddon.ts
@@ -14,6 +14,14 @@ function constrain(value: number, low: number, high: number): number {
return Math.max(low, Math.min(value, high));
}
+function escapeHtmlChar(c: string): string {
+ switch (c) {
+ case '&': return '&';
+ case '<': return '<';
+ }
+ return c;
+}
+
// TODO: Refine this template class later
abstract class BaseSerializeHandler {
constructor(
@@ -669,7 +677,7 @@ export class HTMLSerializeHandler extends BaseSerializeHandler {
if (isEmptyCell) {
this._currentRow += ' ';
} else {
- this._currentRow += cell.getChars();
+ this._currentRow += escapeHtmlChar(cell.getChars());
}
}