コマンド文字をHTMLエスケープ

git-svn-id: http://svn.coderepos.org/share/lang/javascript/vimperator-plugins/trunk@19662 d0d07461-0603-4401-acd4-de1884942a52

1 files changed, 7 insertions, 2 deletions

diff --git a/bufferecho.js b/bufferecho.js
index c1826a9..dc287be 100644
--- a/bufferecho.js
+++ b/bufferecho.js
@@ -3,7 +3,7 @@
  * @name           bufferecho.js
  * @description    Display results of JavaScript to a buffer(browser) instead of commandline-buffer
  * @description-ja JavaScript実行結果をコマンドライン・バッファではなくバッファ(ブラウザ)に表示
- * @version        0.1a
+ * @version        0.1
  * ==/VimperatorPlugin==
  */ 
 liberator.plugins.buffer_echo = (function(){
@@ -18,6 +18,11 @@ function execute(str){
     }
     return result;
 }
+function htmlEscape(str){
+    return str.replace("&","&","g")
+              .replace("<","&lt;","g")
+              .replace(">","&gt;","g");
+}
 
 liberator.commands.addUserCommand(['bufferecho','becho'],'Display results of JavaScript to a buffer(browser)',
     function(args, special){
@@ -34,7 +39,7 @@ var manager = {
     open: function(str, forceNewTab) {
         var result = execute(str);
         if (typeof(result) == "object") result = liberator.util.objectToString(result,true);
-        var data = '<div><h1>' + str + '</h1><pre>' + result + '</pre></div>';
+        var data = '<div><h1>' + htmlEscape(str) + '</h1><pre>' + result + '</pre></div>';
         if (liberator.buffer.title == title && !forceNewTab){
             this.append(data);
             return;