From a6b888b2142608fb415debe2a9c2a6be2f266ec6 Mon Sep 17 00:00:00 2001
From: Andreas Svensson <andreas@syranide.com>
Date: Thu, 26 Dec 2013 01:14:03 +0100
Subject: [PATCH] Escape component keys used in reactid

---
 src/core/__tests__/ReactIdentity-test.js  |  3 ++-
 src/utils/__tests__/ReactChildren-test.js |  5 ++++-
 src/utils/traverseAllChildren.js          | 27 ++++++++++++++++++++++-
 3 files changed, 32 insertions(+), 3 deletions(-)

diff --git a/src/core/__tests__/ReactIdentity-test.js b/src/core/__tests__/ReactIdentity-test.js
index 727ac7dd72..3e6012b229 100644
--- a/src/core/__tests__/ReactIdentity-test.js
+++ b/src/core/__tests__/ReactIdentity-test.js
@@ -137,7 +137,8 @@ describe('ReactIdentity', function() {
   });
 
   it('should not allow scripts in keys to execute', function() {
-    var h4x0rKey = '"><script>window.YOUVEBEENH4X0RED=true;</script><div id="';
+    var h4x0rKey =
+      '"><script>window[\'YOUVEBEENH4X0RED\']=true;</script><div id="';
 
     var attachedContainer = document.createElement('div');
     document.body.appendChild(attachedContainer);
diff --git a/src/utils/__tests__/ReactChildren-test.js b/src/utils/__tests__/ReactChildren-test.js
index ac43f4f030..ebbfe51d03 100644
--- a/src/utils/__tests__/ReactChildren-test.js
+++ b/src/utils/__tests__/ReactChildren-test.js
@@ -288,7 +288,10 @@ describe('ReactChildren', function() {
     var mappedForcedKeys = Object.keys(mappedChildrenForcedKeys);
     expect(mappedForcedKeys).toEqual(expectedForcedKeys);
 
-    var expectedRemappedForcedKeys = ['{{keyZero}}{giraffe}', '{{keyOne}}[0]'];
+    var expectedRemappedForcedKeys = [
+      '{{keyZero^C}{giraffe}',
+      '{{keyOne^C}[0]'
+    ];
     var remappedChildrenForcedKeys =
       ReactChildren.map(mappedChildrenForcedKeys, mapFn);
     expect(
diff --git a/src/utils/traverseAllChildren.js b/src/utils/traverseAllChildren.js
index d3a0c89edb..0406ad268c 100644
--- a/src/utils/traverseAllChildren.js
+++ b/src/utils/traverseAllChildren.js
@@ -30,6 +30,18 @@ var invariant = require('invariant');
  * });
  */
 
+var userProvidedKeyEscaperLookup = {
+  '^': '^X',
+  '.': '^D',
+  '}': '^C'
+};
+
+var userProvidedKeyEscapeRegex = /[.^}]/g;
+
+function userProvidedKeyEscaper(match) {
+  return userProvidedKeyEscaperLookup[match];
+}
+
 /**
  * Generate a key string that identifies a component within a set.
  *
@@ -46,6 +58,19 @@ function getComponentKey(component, index) {
   return '[' + index + ']';
 }
 
+/**
+ * Escape a component key so that it is safe to use in a reactid.
+ *
+ * @param {*} key Component key to be escaped.
+ * @return {string} An escaped string.
+ */
+function escapeUserProvidedKey(text) {
+  return ('' + text).replace(
+    userProvidedKeyEscapeRegex,
+    userProvidedKeyEscaper
+  );
+}
+
 /**
  * Wrap a `key` value explicitly provided by the user to distinguish it from
  * implicitly-generated keys generated by a component's index in its parent.
@@ -54,7 +79,7 @@ function getComponentKey(component, index) {
  * @return {string}
  */
 function wrapUserProvidedKey(key) {
-  return '{' + key + '}';
+  return '{' + escapeUserProvidedKey(key) + '}';
 }
 
 /**