StringBlock.getHTML(): escape XML chars before styling.

This commit is contained in:
Ryszard Wiśniewski 2010-06-13 16:14:29 +02:00
parent 51ec9611f4
commit 2a20dd1b94

View File

@ -125,7 +125,7 @@ public class StringBlock {
} }
int[] style = getStyle(index); int[] style = getStyle(index);
if (style == null) { if (style == null) {
return raw; return escapeForXml(raw);
} }
StringBuilder html = new StringBuilder(raw.length() + 32); StringBuilder html = new StringBuilder(raw.length() + 32);
int offset = 0; int offset = 0;
@ -146,7 +146,7 @@ public class StringBlock {
continue; continue;
} }
if (offset <= end) { if (offset <= end) {
html.append(raw, offset, end + 1); html.append(escapeForXml(raw.substring(offset, end + 1)));
offset = end + 1; offset = end + 1;
} }
style[j + 2] = -1; style[j + 2] = -1;
@ -156,7 +156,7 @@ public class StringBlock {
html.append('>'); html.append('>');
} }
if (offset < start) { if (offset < start) {
html.append(raw, offset, start); html.append(escapeForXml(raw.substring(offset, start)));
offset = start; offset = start;
} }
if (i == -1) { if (i == -1) {
@ -170,6 +170,10 @@ public class StringBlock {
return html.toString(); return html.toString();
} }
private String escapeForXml(String txt) {
return txt.replace("&", "&amp;").replace("<", "&lt;");
}
/** /**
* Finds index of the string. * Finds index of the string.
* Returns -1 if the string was not found. * Returns -1 if the string was not found.