Escape inlined JSPreload JSON data.

r2/r2/lib/js.py

@@ -214,8 +214,9 @@ class DataSource(Source):
         return self.wrap.format(content=json_data) + "\n"
 
     def use(self):
-        from r2.lib.filters import SC_OFF, SC_ON
-        return (SC_OFF + inline_script_tag.format(content=self.get_source()) +
+        from r2.lib.filters import SC_OFF, SC_ON, websafe_json
+        escaped_json = websafe_json(self.get_source())
+        return (SC_OFF + inline_script_tag.format(content=escaped_json) +
                 SC_ON + "\n")
 
     @property

r2/r2/public/static/js/preload.js

@@ -8,7 +8,14 @@ r.preload = {
     },
 
     set: function(data) {
-        _.extend(this.data, data)
+        var unescapedData = r.utils.structuredMap(data, function(val) {
+            if (_.isString(val)) {
+                return _.unescape(val)
+            } else {
+                return val
+            }
+        })
+        _.extend(this.data, unescapedData)
     },
 
     read: function(url) {

r2/r2/public/static/js/utils.js

@@ -31,6 +31,22 @@ r.utils = {
         return list
     },
 
+    structuredMap: function(obj, func) {
+        if (_.isArray(obj)) {
+            return _.map(obj, function(value) {
+                return r.utils.structuredMap(value, func)
+            })
+        } else if (_.isObject(obj)) {
+            var mapped = {}
+            _.each(obj, function(value, key) {
+                mapped[func(key, 'key')] = r.utils.structuredMap(value, func)
+            })
+            return mapped
+        } else {
+            return func(obj, 'value')
+        }
+    },
+
     querySelectorFromEl: function(targetEl, selector) {
         return $(targetEl).parents().andSelf()
             .filter(selector || '*')