Escaping a string to be placed in generated JavaScript source, in JavaScript

Question

I'm writing code that will generate some javascript. The javascript will involve assigning a variable in the generated code to a string passed into the generator. The generator is also in javascript.

Basically I want to do this:

function generate_code(text) {
    return "var a = " + jsEscapeString(text) + "; alert(a);";
}
function jsEscapeString(text) {
    // WHAT GOES HERE?
    // e.g. it needs to:
    // - surround with quotes
    // - escape quotes inside the text
    // - escape backslashes and newlines and other fun characters
    // - defend against other horrible things I probably don't know about
}

I don't want something that only works in the happy case. I want something correct. Something that would survive a malicious adversary trying to do sandbox escapes on the resulting code (e.g. like what you do in the game 'Untrusted').

(This question is probably a duplicate, but my google-fu is failing me.) — Craig Gidney
– Craig Gidney, Commented Sep 20, 2015 at 23:36

Niet the Dark Absol · Accepted Answer · 2015-09-20 23:47:55Z

4

Super easy.

function jsEscapeString(text) {
    return JSON.stringify(text);
}

No matter what you put in, you will ALWAYS get a valid representation of it that can be dumped into JS source. The result, when executed, will always be exactly what you put in.

This even works for strings, booleans, numbers, arrays, objects... basically everything you'll ever need.

Although I'm curious as to why you're doing this... This smells of eval fishiness...

answered Sep 20, 2015 at 23:47

Niet the Dark Absol

326k86 gold badges480 silver badges604 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Craig Gidney Over a year ago

Ah, of course. (It's for a widget where users can enter javascript as part of solving a puzzle. It's not security sensitive or affecting data that matters, I just didn't want to write it in a way that would break as soon as they included a quote.)

Guffa · Accepted Answer · 2015-09-20 23:50:39Z

-1

You would need to escape backslash, the string delimiter, and control characters:

function jsEscapeString(text) {
  return '"' +
    text
    .replace(/\\/g, '\\\\')
    .replace(/"/g, '\\"')
    .replace(/\r/g, '\\r')
    .replace(/\n/g, '\\n')
    .replace(/\t/g, '\\t')
    .replace(/\b/g, '\\b')
    .replace(/\v/g, '\\v')
    .replace(/\f/g, '\\f')
    + '"';
}

answered Sep 20, 2015 at 23:50

Guffa

703k111 gold badges760 silver badges1k bronze badges

4 Comments

Craig Gidney Over a year ago

There's no unicode characters that can break strings, such as alternative characters for starting a new line?

Guffa Over a year ago

@Strilanc: No, there is no purpose for other new line characters, and other character have no special meaning. Unicode has alternative quotation marks for example, but JavaScript doesn't allow those as string delimiters.

AnrDaemon Over a year ago

It is extremely useless to escape \r\n\t\b\v\f in generated code. Yes, the result may not look desirable, but more often than not the effort is wasted.

Guffa Over a year ago

@AnrDaemon: Why do you think that it is "extremely useless" when it makes the difference between the code not working and the code working? Why do you think that this way of escaping characters are useless, but using JSON.stringify is not, when they do essentially the same thing?

Collectives™ on Stack Overflow

Escaping a string to be placed in generated JavaScript source, in JavaScript

2 Answers 2

1 Comment

4 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

4 Comments

Your Answer

Sign up or log in

Post as a guest

Related