diff --git a/cat/js/cat.js b/cat/js/cat.js index 08513ed..eddcde7 100644 --- a/cat/js/cat.js +++ b/cat/js/cat.js @@ -69,10 +69,10 @@ function renderResult(data) { for(var i = 0; i < data['result']['bestOverlay'].length; i++) { var fragment = data['result']['bestOverlay'][i]; //previous unmarked fragment - markedSentence += inputSentence.slice(lastInsertedEnd, fragment['matchedPatternStart']); + markedSentence += htmlEncode(inputSentence.slice(lastInsertedEnd, fragment['matchedPatternStart'])); //the marked fragment - markedSentence += ''+inputSentence.slice(fragment['matchedPatternStart'], fragment['matchedPatternEnd'])+''; + markedSentence += ''+htmlEncode(inputSentence.slice(fragment['matchedPatternStart'], fragment['matchedPatternEnd']))+''; lastInsertedEnd = fragment['matchedPatternEnd']; @@ -80,7 +80,7 @@ function renderResult(data) { } //remaining unmarked fragment - markedSentence += inputSentence.slice(lastInsertedEnd); + markedSentence += htmlEncode(inputSentence.slice(lastInsertedEnd)); res += '
'+markedSentence+'
'; @@ -89,6 +89,12 @@ function renderResult(data) { return res; } +function htmlEncode(value){ + // Create a in-memory div, set its inner text (which jQuery automatically encodes) + // Then grab the encoded contents back out. The div never exists on the page. + return $('
').text(value).html(); +} + function renderFragment(fragment, number) { var result = '