Added escaping in VirtualComments.

astoilkov · Oct 3, 2016 · d5acc8a · d5acc8a
1 parent 7e2cf5c
commit d5acc8a
Showing 1 changed file with 4 additions and 3 deletions.
diff --git a/src/query/VirtualComment.js b/src/query/VirtualComment.js
@@ -2,8 +2,9 @@
   '../core',
   '../var/trimRegExp',
   './var/dataIdAttr',
-  './VirtualElement'
-], function (blocks, trimRegExp, dataIdAttr, VirtualElement) {
+  './VirtualElement',
+  '../modules/Escape'
+], function (blocks, trimRegExp, dataIdAttr, VirtualElement, Escape) {
   function VirtualComment(commentText) {
     if (!VirtualComment.prototype.isPrototypeOf(this)) {
       return new VirtualComment(commentText);
@@ -27,7 +28,7 @@
       if (dataId) {
         html += dataId + ':';
       }
-      html += this._commentText.replace(trimRegExp, '') + ' -->';
+      html += Escape.forHTML(this._commentText.replace(trimRegExp, '')) + ' -->';
 
       return html;
     },