Repository: Polymer/vulcanize
Pull request #312 (2016-03-01 22:52:39)

Escape firebase's script creation
'\x3c/script>' ain't good enough for being inlined!


Patch:
diff --git a/package.json b/package.json
index 0057dcf..d9b5195 100644
--- a/package.json
+++ b/package.json
@@ -15,6 +15,7 @@
   },
   "devDependencies": {
     "chai": "^3.4.1",
+    "firebase": "^2.4.1",
     "jshint": "^2.7.0",
     "mocha": "^2.2.4"
   },
diff --git a/third_party/UglifyJS2/README.md b/third_party/UglifyJS2/README.md
index 14a5799..a946c71 100644
--- a/third_party/UglifyJS2/README.md
+++ b/third_party/UglifyJS2/README.md
@@ -12,6 +12,7 @@ https://raw.githubusercontent.com/mishoo/UglifyJS2/v2.6.1/lib/output.js
 - Added CommonJS `module.exports` line
 - Added `jshint` settins line
 - Removed semicolon from defintion of `encode_string`
+- Escape scripts with `\x3c/script` syntax
 
 # License
 BSD-2-Clause: [License](https://raw.githubusercontent.com/mishoo/UglifyJS2/v2.6.1/LICENSE)
diff --git a/third_party/UglifyJS2/output.js b/third_party/UglifyJS2/output.js
index 324520b..4e355bd 100644
--- a/third_party/UglifyJS2/output.js
+++ b/third_party/UglifyJS2/output.js
@@ -52,7 +52,7 @@ var options = {
 function encode_string(str, quote) {
   var ret = str;
   if (options.inline_script) {
-    ret = ret.replace(/<\x2fscript([>\/\t\n\f\r ])/gi, "<\\/script$1");
+    ret = ret.replace(/(<|\\x3c)\x2fscript([>\/\t\n\f\r ])/gi, "$1\\/script$2");
     ret = ret.replace(/\x3c!--/g, "\\x3c!--");
     ret = ret.replace(/--\x3e/g, "--\\x3e");
   }


Test patch:
diff --git a/test/html/firebase.html b/test/html/firebase.html
new file mode 100644
index 0000000..c841a6b
--- /dev/null
+++ b/test/html/firebase.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<!--
+    @license
+    Copyright (c) 2014 The Polymer Project Authors. All rights reserved.
+    This code may only be used under the BSD style license found at http://polymer.github.io/LICENSE.txt
+    The complete set of authors may be found at http://polymer.github.io/AUTHORS.txt
+    The complete set of contributors may be found at http://polymer.github.io/CONTRIBUTORS.txt
+    Code distributed by Google as part of the polymer project is also
+    subject to an additional IP rights grant found at http://polymer.github.io/PATENTS.txt
+-->
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <title>Firebase</title>
+  <script src="../../node_modules/firebase/lib/firebase-web.js"></script>
+</head>
+<body>
+</body>
+</html>
diff --git a/test/test.js b/test/test.js
index 643327a..cdb62c4 100644
--- a/test/test.js
+++ b/test/test.js
@@ -828,6 +828,20 @@ suite('Vulcan', function() {
       };
       process('test/html/reordered/in.html', callback, options);
     });
+
+    test('Firebase works inlined', function(done) {
+      var callback = function(err, doc) {
+        if (err) {
+          return done(err);
+        }
+        var scripts = dom5.queryAll(doc, matchers.JS_INLINE);
+        assert.equal(scripts.length, 1);
+        var idx = dom5.getTextContent(scripts[0]).indexOf('</script>');
+        assert(idx === -1, '/script found, should be escaped');
+        done();
+      };
+      process('test/html/firebase.html', callback, options);
+    });
   });
 
   suite('Inline CSS', function() {