The value of window.__karma__.files is not properly escaped

[Joris-van-der-Wel]

One of the files being served in my project has a single quote in its name. Karma is unable to run any tests because of this.

This is the culprit:

karma/lib/middleware/karma.js

Line 148 in 19dd824

mappings = 'window.__karma__.files = {\n' + mappings.join(',\n') + '\n};\n'

Why not use JSON.stringify()?

[Moumi]

It seems that this issue can be solved for single quotes, but for double quotes... Well, you should never create double quotes in a filename. So, I worked on a fix and test for this and will provide a PR this evening for it.

[Joris-van-der-Wel]

Would it not be easier to use:

return util.format("  %s: '%s'", JSON.stringify(filePath), file.sha)

This way you can not make any mistake in the escaping.

console.log(JSON.stringify('foo\n"bar"')) // "foo\n\"bar\""

[Moumi]

There are some cases that when a character is escaped the loading of the file would go wrong. The most safe way would be to find the cases that are 'common' and escape only those characters.

[Joris-van-der-Wel]

How so?

All that we are doing is passing a JavaScript variable from one context (node) to another (the browser), JSON.stringify should take care of that. If something starts failing with that, you probably discovered a different issue.

[alancutter]

I'm still hitting this problem in the latest release: https://github.com/karma-runner/karma/releases/tag/v0.13.22
The merged change doesn't seem to be included for some reason.
https://github.com/karma-runner/karma/blob/v0.13.22/lib/middleware/karma.js#L139