Merge pull request #104 from ramnathv/joe/bugfix/script-end-tag

Fix a bug with </script> appearing in widget data

R/htmlwidgets.R

@@ -122,8 +122,15 @@ widget_dependencies <- function(name, package){
 # Generates a <script type="application/json"> tag with the JSON-encoded data,
 # to be picked up by htmlwidgets.js for static rendering.
 widget_data <- function(x, id, ...){
+  # It's illegal for </script> to appear inside of a script tag, even if it's
+  # inside a quoted string. Fortunately we know that in JSON, the only place
+  # the '<' character can appear is inside a quoted string, where a Unicode
+  # escape has the same effect, without confusing the browser's parser. The
+  # repro for the bug this gsub fixes is to have the string "</script>" appear
+  # anywhere in the data/metadata of a widget--you will get a syntax error
+  # instead of a properly rendered widget.
   tags$script(type="application/json", `data-for` = id,
-    HTML(toJSON(createPayload(x)))
+    HTML(gsub("<", "\\\\u003c", toJSON(createPayload(x))))
   )
 }