Issue 7284 - Move CSS escaping to createStyleSheet

lib/elemHide.js

Index: lib/elemHide.js
===================================================================
--- a/lib/elemHide.js
+++ b/lib/elemHide.js
@@ -472,29 +472,41 @@
   // this could still lead to some selectors not working on Chromium, but it is
   // highly unlikely.
   // See issue #6298 and https://crbug.com/804179
   for (let i = 0; i < selectors.length; i += selectorGroupSize)
     yield selectors.slice(i, i + selectorGroupSize);
 }
 
 /**
+ * Escape curly braces to prevent CSS rule injection.

[Manish Jethani, 2019/02/13 12:27:25]

s/Escape/Escapes/

[hub, 2019/02/13 16:33:32]

Done.

+ *
+ * @param {string} selector
+ * @return {string}

[Manish Jethani, 2019/02/13 12:27:25]

s/@return/@returns/

[hub, 2019/02/13 16:33:31]

Done.

+ */
+function escapedSelector(selector)

[hub, 2019/02/12 23:55:49]

while we expect a string, if `selector` is undefined it will throw an error. The
bug in test I fixed was triggering it.
So I'm pondering if we shouldn't check for undefined (and null?).

[Manish Jethani, 2019/02/13 12:27:25]

If it's always going to be a string in practice then we should not check for
null. The tests should not try to pass a non-string.

[Manish Jethani, 2019/02/13 12:27:25]

Let's rename to `escapeSelector`

[hub, 2019/02/13 16:33:32]

Done.

+{
+  return selector.replace("{", "\\7B ").replace("}", "\\7D ");
+}
+
+/**
  * Creates an element hiding CSS rule for a given list of selectors.
  *
  * @param {Array.<string>} selectors
  * @returns {string}
  */
 function createRule(selectors)
 {
   let rule = "";
 
   for (let i = 0; i < selectors.length - 1; i++)
-    rule += selectors[i] + ", ";
+    rule += escapedSelector(selectors[i]) + ", ";
 
-  rule += selectors[selectors.length - 1] + " {display: none !important;}\n";
+  rule += escapedSelector(selectors[selectors.length - 1]) +
+    " {display: none !important;}\n";

[Manish Jethani, 2019/02/13 12:27:25]

Nit: The double quote here should be in the same column as the 'e' of
'escapedSelector' above.

[hub, 2019/02/13 16:33:32]

Done.

 
   return rule;
 }
 
 /**
  * Creates an element hiding CSS style sheet from a given list of selectors.
  * @param {Array.<string>} selectors
  * @returns {string}