Escape attr before using in querySelectorAll. Closes #156.

oddbird · Feb 28, 2024 · 3d60849 · 3d60849
1 parent 3b55af9
commit 3d60849
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 1 deletion.
diff --git a/src/parse.ts b/src/parse.ts
@@ -449,7 +449,9 @@ async function getAnchorEl(
     if (customPropName) {
       anchorName = getCSSPropertyValue(targetEl, customPropName);
     } else if (anchorAttr) {
-      return await validatedForPositioning(targetEl, [`#${anchorAttr}`]);
+      return await validatedForPositioning(targetEl, [
+        `#${CSS.escape(anchorAttr)}`,
+      ]);
     }
   }
   const anchorSelectors = anchorName ? anchorNames[anchorName] ?? [] : [];

diff --git a/tests/unit/setup.ts b/tests/unit/setup.ts
@@ -1,5 +1,13 @@
 import fetchMock from 'fetch-mock';
 
+beforeAll(() => {
+  // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+  // @ts-ignore
+  window.CSS = {
+    escape: (str) => str,
+  };
+});
+
 afterEach(() => {
   fetchMock.reset();
 });