Handle regex special chars in replaceAll polyfill

Fixes #6206
See #6047 and #6208

1 files changed, 11 insertions, 7 deletions

diff --git a/qutebrowser/javascript/quirks/string_replaceall.user.js b/qutebrowser/javascript/quirks/string_replaceall.user.js
index e2fd20be2..03e079364 100644
--- a/qutebrowser/javascript/quirks/string_replaceall.user.js
+++ b/qutebrowser/javascript/quirks/string_replaceall.user.js
@@ -1,23 +1,27 @@
-// Based on: https://vanillajstoolkit.com/polyfills/stringreplaceall/
-/* eslint-disable no-extend-native */
+/* eslint-disable no-extend-native,no-implicit-globals */
+
+"use strict";
+
+// https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_Expressions
+function escapeRegExp(string) {
+    return string.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
 
+// Based on: https://vanillajstoolkit.com/polyfills/stringreplaceall/
 /**
  * String.prototype.replaceAll() polyfill
  * https://gomakethings.com/how-to-replace-a-section-of-a-string-with-another-one-with-vanilla-js/
  * @author Chris Ferdinandi
  * @license MIT
  */
-
-"use strict";
-
 if (!String.prototype.replaceAll) {
     String.prototype.replaceAll = function(str, newStr) {
         // If a regex pattern
-        if (Object.prototype.toString.call(str).toLowerCase() === "[object regexp]") {
+        if (Object.prototype.toString.call(str) === "[object RegExp]") {
             return this.replace(str, newStr);
         }
 
         // If a string
-        return this.replace(new RegExp(str, "g"), newStr);
+        return this.replace(new RegExp(escapeRegExp(str), "g"), newStr);
     };
 }