Core: Escape single quotes in names avoiding a Sizzle Error being thrown

Arkni · Arkni · commit 10f4357f5ed5 · 2015-10-09T17:20:28.000+01:00
When a name or ID contains single quotes, a Sizzle error will be thrown,
so to avoid that, we have to escape all single quotes in that name or ID
before using it.
diff --git a/src/core.js b/src/core.js
@@ -803,7 +803,7 @@ $.extend( $.validator, {
 				if ( error.is( "label" ) ) {
 					// If the error is a label, then associate using 'for'
 					error.attr( "for", elementID );
-				} else if ( error.parents( "label[for='" + elementID + "']" ).length === 0 ) {
+				} else if ( error.parents( "label[for='" + elementID.replace( /'/g, "\\'" ) + "']" ).length === 0 ) {
 					// If the element is not a child of an associated label, then it's necessary
 					// to explicitly apply aria-describedby
 
@@ -822,7 +822,7 @@ $.extend( $.validator, {
 					if ( group ) {
 						$.each( this.groups, function( name, testgroup ) {
 							if ( testgroup === group ) {
-								$( "[name='" + name + "']", this.currentForm )
+								$( "[name='" + name.replace( /'/g, "\\'" ) + "']", this.currentForm )
 									.attr( "aria-describedby", error.attr( "id" ) );
 							}
 						} );
@@ -841,14 +841,17 @@ $.extend( $.validator, {
 		},
 
 		errorsFor: function( element ) {
-			var name = this.idOrName( element ),
+			var name = this.idOrName( element ).replace( /'/g, "\\'" ),
 				describer = $( element ).attr( "aria-describedby" ),
 				selector = "label[for='" + name + "'], label[for='" + name + "'] *";
 
 			// aria-describedby should directly reference the error element
 			if ( describer ) {
-				selector = selector + ", #" + describer.replace( /\s+/g, ", #" );
+				selector = selector + ", #" + describer
+					.replace( /'/g, "\\'" )
+					.replace( /\s+/g, ", #" );
 			}
+
 			return this
 				.errors()
 				.filter( selector );
@@ -874,7 +877,7 @@ $.extend( $.validator, {
 		},
 
 		findByName: function( name ) {
-			return $( this.currentForm ).find( "[name='" + name + "']" );
+			return $( this.currentForm ).find( "[name='" + name.replace( /'/g, "\\'" ) + "']" );
 		},
 
 		getLength: function( value, element ) {
