escape dictionary name for dynamic handlebars (#1032)

* escape apostrophe in dict name for dynamic handlebars

* try handling backslashes

1 files changed, 13 insertions, 3 deletions

diff --git a/ext/js/data/anki-template-util.js b/ext/js/data/anki-template-util.js
index 0051e3b5..68369fc9 100644
--- a/ext/js/data/anki-template-util.js
+++ b/ext/js/data/anki-template-util.js
@@ -108,15 +108,15 @@ export function getDynamicTemplates(options) {
         if (!dictionary.enabled) { continue; }
         dynamicTemplates += `
 {{#*inline "single-glossary-${getKebabCase(dictionary.name)}"}}
-    {{~> glossary selectedDictionary='${dictionary.name}'}}
+    {{~> glossary selectedDictionary='${escapeDictName(dictionary.name)}'}}
 {{/inline}}
 
 {{#*inline "single-glossary-${getKebabCase(dictionary.name)}-no-dictionary"}}
-    {{~> glossary selectedDictionary='${dictionary.name}' noDictionaryTag=true}}
+    {{~> glossary selectedDictionary='${escapeDictName(dictionary.name)}' noDictionaryTag=true}}
 {{/inline}}
 
 {{#*inline "single-glossary-${getKebabCase(dictionary.name)}-brief"}}
-    {{~> glossary selectedDictionary='${dictionary.name}' brief=true}}
+    {{~> glossary selectedDictionary='${escapeDictName(dictionary.name)}' brief=true}}
 {{/inline}}
 `;
     }
@@ -148,3 +148,13 @@ function getKebabCase(str) {
         .replace(/^-|-$/g, '')
         .toLowerCase();
 }
+
+/**
+ * @param {string} name
+ * @returns {string}
+ */
+function escapeDictName(name) {
+    return name
+        .replace(/\\/g, '\\\\')
+        .replace(/'/g, '\\\'');
+}