Bug 1279842 - Explicitly escape markup instead of using generic HTML escape function. r?m_kato draft
authorEitan Isaacson <eitan@monotonous.org>
Wed, 21 Sep 2016 10:33:45 -0700
changeset 416197 3f4e59a86e576f69af5f335473a551ffd4bb28bb
parent 416196 4b7879771bdf3bfaf94144d9ba3e6a14fd1afd18
child 531781 3f15bea2a74d03f51a466738986c645fe345a698
push id30062
push userbmo:eitan@monotonous.org
push dateWed, 21 Sep 2016 17:42:56 +0000
reviewersm_kato
bugs1279842
milestone51.0a1
Bug 1279842 - Explicitly escape markup instead of using generic HTML escape function. r?m_kato MozReview-Commit-ID: 2vk8lffmDh4
dom/media/webspeech/synth/windows/SapiService.cpp
--- a/dom/media/webspeech/synth/windows/SapiService.cpp
+++ b/dom/media/webspeech/synth/windows/SapiService.cpp
@@ -369,23 +369,32 @@ SapiService::Speak(const nsAString& aTex
   // Set the pitch using xml
   nsAutoString xml;
   xml.AssignLiteral("<pitch absmiddle=\"");
   // absmiddle doesn't allow float type
   xml.AppendInt(static_cast<int32_t>(aPitch * 10.0f - 10.0f));
   xml.AppendLiteral("\">");
   uint32_t textOffset = xml.Length();
 
-  const char16_t* escapedText =
-    nsEscapeHTML2(aText.BeginReading(), aText.Length());
-  if (!escapedText) {
-    return NS_ERROR_OUT_OF_MEMORY;
+  for (size_t i = 0; i < aText.Length(); i++) {
+    switch (aText[i]) {
+      case '&':
+        xml.AppendLiteral("&amp;");
+        break;
+      case '<':
+        xml.AppendLiteral("&lt;");
+        break;
+      case '>':
+        xml.AppendLiteral("&gt;");
+        break;
+      default:
+        xml.Append(aText[i]);
+        break;
+    }
   }
-  xml.Append(escapedText);
-  free((void*)escapedText);
 
   xml.AppendLiteral("</pitch>");
 
   RefPtr<SapiCallback> callback =
     new SapiCallback(aTask, spVoice, textOffset, aText.Length());
 
   // The last three parameters doesn't matter for an indirect service
   nsresult rv = aTask->Setup(callback, 0, 0, 0);