From 26e193a5fac0ac3ac74349ce7a53e640fb2bd32c Mon Sep 17 00:00:00 2001
From: "Mr. Pennyworth" <mr-pennyworth@users.noreply.github.com>
Date: Sun, 4 Aug 2024 07:54:17 -0500
Subject: [PATCH] Correctly escape CSS before injecting into the pane
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Example CSS that broke injection before, but not
now (from Apple Dictionaries CSS):

```css
span.hsb:before
{
    /* '•' */
    content: '\2022';
    font-size: 80%;
    vertical-align: 3%;
}
```
---
 AlfredExtraPane.xcodeproj/project.pbxproj | 4 ++--
 AlfredExtraPane/WebViewInjection.swift    | 5 +++--
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/AlfredExtraPane.xcodeproj/project.pbxproj b/AlfredExtraPane.xcodeproj/project.pbxproj
index 3846d97..4edee1a 100644
--- a/AlfredExtraPane.xcodeproj/project.pbxproj
+++ b/AlfredExtraPane.xcodeproj/project.pbxproj
@@ -413,7 +413,7 @@
 					"@executable_path/../Frameworks",
 				);
 				MACOSX_DEPLOYMENT_TARGET = 11.0;
-				MARKETING_VERSION = 0.2.5;
+				MARKETING_VERSION = 0.2.6;
 				ONLY_ACTIVE_ARCH = NO;
 				OTHER_CODE_SIGN_FLAGS = "--deep";
 				PRODUCT_BUNDLE_IDENTIFIER = mr.pennyworth.AlfredExtraPane;
@@ -434,7 +434,7 @@
 					"@executable_path/../Frameworks",
 				);
 				MACOSX_DEPLOYMENT_TARGET = 11.0;
-				MARKETING_VERSION = 0.2.5;
+				MARKETING_VERSION = 0.2.6;
 				ONLY_ACTIVE_ARCH = NO;
 				OTHER_CODE_SIGN_FLAGS = "--deep";
 				PRODUCT_BUNDLE_IDENTIFIER = mr.pennyworth.AlfredExtraPane;
diff --git a/AlfredExtraPane/WebViewInjection.swift b/AlfredExtraPane/WebViewInjection.swift
index 145596d..156f71f 100644
--- a/AlfredExtraPane/WebViewInjection.swift
+++ b/AlfredExtraPane/WebViewInjection.swift
@@ -9,9 +9,10 @@ private let cssInjectedMessageName = "cssInjected"
 /// The only way is to inject a <style> tag into the document by executing
 /// JS in the webview.
 private func injecterJS(_ cssString: String) -> String {
-  """
+  let escapedCssString = cssString.replacingOccurrences(of: "\\", with: "\\\\")
+  return """
   var style = document.createElement('style');
-  style.innerHTML = `\(cssString)`;
+  style.innerHTML = `\(escapedCssString)`;
   document.head.appendChild(style);
   window.webkit.messageHandlers.\(cssInjectedMessageName).postMessage('done');
   """