Issue 1527 - Properly escape generated CSS selectors

include.postload.js

 /*
  * This file is part of Adblock Plus <http://adblockplus.org/>,
  * Copyright (C) 2006-2014 Eyeo GmbH
  *
  * Adblock Plus is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
  * published by the Free Software Foundation.
  *
  * Adblock Plus is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with Adblock Plus.  If not, see <http://www.gnu.org/licenses/>.
  */
 
 // Click-to-hide stuff
 var clickHide_activated = false;
 var clickHide_filters = null;
 var currentElement = null;
 var clickHideFilters = null;
 var highlightedElementsSelector = null;
 var clickHideFiltersDialog = null;
 var lastRightClickEvent = null;
 
-var ctrlChar = /[\x00-\x1F\x7F]/g;
-
-function escapeLiteral(chr)
-{
+function escapeChar(chr)
+{
+  var code = chr.charCodeAt(0);
+
+  if (code <= 0x1F || code == 0x7F || /\d/.test(chr))
+    return "\\" + code.toString(16) + " ";
+
   return "\\" + chr;
 }
 
-function escapeWithCharCode(chr)
-{
-  return "\\" + chr.charCodeAt(0).toString(16) + " ";
-}
-
 function quote(value)
 {
-  value = value.replace(/["\\]/g, escapeLiteral);
-  value = value.replace(ctrlChar, escapeWithCharCode);
-
-  return '"' + value + '"';
-}
-
-function escapeToken(s)
-{
-  return s.replace(
-    /^\d|^-(?![^\d-])|[^\w-\u0080-\uFFFF]/g,

[Wladimir Palant, 2014/11/05 19:56:52]

Constructing character classes that deal with large ranges was highly
inefficient last time I tried using them. However,
http://jsperf.com/character-classes-performance seems to confirm that there is
no significant performance difference in modern browsers (anything below factor
10 doesn't really matter here, performance of this code isn't critical).

[Sebastian Noack, 2014/11/06 08:25:14]

You forgot to run the regex, but there still isn't a notable difference:
http://jsperf.com/character-classes-performance/2

[Wladimir Palant, 2014/11/06 14:13:59]

No, I didn't intend to run it - the slowdown I know happened during
initialization.

-
-    function(chr)
-    {
-      if (ctrlChar.test(chr) || /\d/.test(chr))
-        return escapeWithCharCode(chr);
-
-      return escapeLiteral(chr);
-    }
-  );
+  return '"' + value.replace(/["\\\x00-\x1F\x7F]/g, escapeChar) + '"';
+}
+
+function escapeCSS(s)
+{
+  return s.replace(/^[\d\-]|[^\w\-\u0080-\uFFFF]/g, escapeChar);
 }
 
 function supportsShadowRoot(element)
 {
   if (!("createShadowRoot" in element))
     return false;
 
   // There are some elements (e.g. <textarea>), which don't
   // support author created shadow roots and throw an exception.
   var clone = element.cloneNode(false);
@@ skipping 339 matching lines @@
   clickHideFilters = new Array();
   selectorList = new Array();
 
   var addSelector = function(selector)
   {
     clickHideFilters.push(document.domain + "##" + selector);
     selectorList.push(selector);
   };
 
   if (elt.id)
-    addSelector("#" + escapeToken(elt.id));
+    addSelector("#" + escapeCSS(elt.id));
 
   if (elt.classList.length > 0)
   {
     var selector = "";
 
     for (var i = 0; i < elt.classList.length; i++)
-      selector += "." + escapeToken(elt.classList[i]);
+      selector += "." + escapeCSS(elt.classList[i]);
 
     addSelector(selector);
   }
 
   if (url)
   {
     var src = elt.getAttribute("src");
-    var selector = src && escapeToken(elt.localName) + '[src=' + quote(src) + ']';
+    var selector = src && escapeCSS(elt.localName) + '[src=' + quote(src) + ']';
 
     if (/^https?:/i.test(url))
     {
       clickHideFilters.push(url.replace(/^[\w\-]+:\/+(?:www\.)?/, "||"));
 
       if (selector)
         selectorList.push(selector);
     }
     else if (selector)
       addSelector(selector);
   }
 
   // restore the original style, before generating the fallback filter that
   // will include the style, and to prevent highlightElements from saving those
   unhighlightElement(currentElement);
 
   // as last resort, create a filter based on inline styles
   if (clickHideFilters.length == 0)
   {
     var style = elt.getAttribute("style");
     if (style)
-      addSelector(escapeToken(elt.localName) + '[style=' + quote(style) + ']');
+      addSelector(escapeCSS(elt.localName) + '[style=' + quote(style) + ']');
   }
 
   // Show popup
   clickHide_showDialog(e.clientX, e.clientY, clickHideFilters);
 
   // Highlight the elements specified by selector in yellow
   highlightElements(selectorList.join(","));
   // Now, actually highlight the element the user clicked on in red
   highlightElement(currentElement, "#fd1708", "#f6a1b5");
 
@@ skipping 218 matching lines @@
         break;
       default:
         sendResponse({});
         break;
     }
   });
 
   if (window == window.top)
     ext.backgroundPage.sendMessage({type: "report-html-page"});
 }