Ticket #11778: patch.diff

django/template/defaultfilters.py

@@ -85 +85 @@
 _js_escapes = (_base_js_escapes +
                tuple([('%c' % z, '\\x%02X' % z) for z in range(32)]))
 
+_js_escapes_dict={}
+for k, v in _js_escapes:
+    _js_escapes_dict[k]=v
+
+_js_escapes_re = re.compile(u'[\u0000-\u001f]|\\\\|\'|"|>|<|&|=|-|;')
+
 def escapejs(value):
-    """Hex encodes characters for use in JavaScript strings."""
-    for bad, good in _js_escapes:
-        value = value.replace(bad, good)
-    return value
+    """Hex encodes characters for use in JavaScript strings.""" 
+    return _js_escapes_re.sub(lambda m: _js_escapes_dict[m.group(0)], value)
 escapejs = stringfilter(escapejs)
 
 def fix_ampersands(value):