Issue 7284 - Move CSS escaping to createStyleSheet

lib/elemHide.js

 /*
  * This file is part of Adblock Plus <https://adblockplus.org/>,
  * Copyright (C) 2006-present eyeo GmbH
  *
  * Adblock Plus is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
  * published by the Free Software Foundation.
  *
  * Adblock Plus is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ skipping 459 matching lines @@
   // calculate the sizes of the selectors and divide them up accordingly, but
   // this approach is more efficient and has worked well in practice. In theory
   // this could still lead to some selectors not working on Chromium, but it is
   // highly unlikely.
   // See issue #6298 and https://crbug.com/804179
   for (let i = 0; i < selectors.length; i += selectorGroupSize)
     yield selectors.slice(i, i + selectorGroupSize);
 }
 
 /**
+ * Escapes curly braces to prevent CSS rule injection.
+ *
+ * @param {string} selector
+ * @returns {string}
+ */
+function escapeSelector(selector)
+{
+  return selector.replace("{", "\\7B ").replace("}", "\\7D ");
+}
+
+/**
  * Creates an element hiding CSS rule for a given list of selectors.
  *
  * @param {Array.<string>} selectors
  * @returns {string}
  */
 function createRule(selectors)
 {
   let rule = "";
 
   for (let i = 0; i < selectors.length - 1; i++)
-    rule += selectors[i] + ", ";
+    rule += escapeSelector(selectors[i]) + ", ";
 
-  rule += selectors[selectors.length - 1] + " {display: none !important;}\n";
+  rule += escapeSelector(selectors[selectors.length - 1]) +
+          " {display: none !important;}\n";
 
   return rule;
 }
 
 /**
  * Creates an element hiding CSS style sheet from a given list of selectors.
  * @param {Array.<string>} selectors
  * @returns {string}
  */
 function createStyleSheet(selectors)
 {
   let styleSheet = "";
 
   for (let selectorGroup of splitSelectors(selectors))
     styleSheet += createRule(selectorGroup);
 
   return styleSheet;
 }
 
 exports.createStyleSheet = createStyleSheet;