Fixed: escape strings in HTML reporter. Closes #164

lib/reporters/html.js

@@ -5,7 +5,8 @@
 
 var Base = require('./base')
   , utils = require('../utils')
-  , Progress = require('../browser/progress');
+  , Progress = require('../browser/progress')
+  , escape = utils.escape;
 
 /**
  * Expose `Doc`.
@@ -94,20 +95,18 @@ function HTML(runner) {
 
     // test
     if (test.passed) {
-      var el = $('<div class="test pass"><h2>' + test.title + '</h2></div>')
+      var el = $('<div class="test pass"><h2>' + escape(test.title) + '</h2></div>')
     } else if (test.pending) {
-      var el = $('<div class="test pass pending"><h2>' + test.title + '</h2></div>')
+      var el = $('<div class="test pass pending"><h2>' + escape(test.title) + '</h2></div>')
     } else {
-      var el = $('<div class="test fail"><h2>' + test.title + '</h2></div>');
+      var el = $('<div class="test fail"><h2>' + escape(test.title) + '</h2></div>');
       var str = test.err.stack || test.err;
 
       // <=IE7 stringifies to [Object Error]. Since it can be overloaded, we
       // check for the result of the stringifying.
-      if ('[object Error]' == str) {
-        str = test.err.message;
-      }
+      if ('[object Error]' == str) str = test.err.message;
 
-      var err = $('<pre class="error">' + str + '</pre>');
+      var err = $('<pre class="error">' + escape(str) + '</pre>');
       el.append(err);
     }
 
@@ -121,7 +120,7 @@ function HTML(runner) {
     // code
     // TODO: defer
     if (!test.pending) {
-      var code = utils.escape(clean(test.fn.toString()));
+      var code = escape(clean(test.fn.toString()));
       var pre = $('<pre><code>' + code + '</code></pre>');
       pre.appendTo(el).hide();
     }