1 | /**
|
2 | * Copyright (c) 2016-present, Facebook, Inc.
|
3 | *
|
4 | * This source code is licensed under the MIT license found in the
|
5 | * LICENSE file in the root directory of this source tree.
|
6 | *
|
7 | * Based on the escape-html library, which is used under the MIT License below:
|
8 | *
|
9 | * Copyright (c) 2012-2013 TJ Holowaychuk
|
10 | * Copyright (c) 2015 Andreas Lubbe
|
11 | * Copyright (c) 2015 Tiancheng "Timothy" Gu
|
12 | *
|
13 | * Permission is hereby granted, free of charge, to any person obtaining
|
14 | * a copy of this software and associated documentation files (the
|
15 | * 'Software'), to deal in the Software without restriction, including
|
16 | * without limitation the rights to use, copy, modify, merge, publish,
|
17 | * distribute, sublicense, and/or sell copies of the Software, and to
|
18 | * permit persons to whom the Software is furnished to do so, subject to
|
19 | * the following conditions:
|
20 | *
|
21 | * The above copyright notice and this permission notice shall be
|
22 | * included in all copies or substantial portions of the Software.
|
23 | *
|
24 | * THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
|
25 | * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
|
26 | * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
|
27 | * IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
|
28 | * CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
|
29 | * TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
|
30 | * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
|
31 | *
|
32 | */
|
33 |
|
34 | ;
|
35 |
|
36 | // code copied and modified from escape-html
|
37 | /**
|
38 | * Module variables.
|
39 | * @private
|
40 | */
|
41 |
|
42 | var matchHtmlRegExp = /["'&<>]/;
|
43 |
|
44 | /**
|
45 | * Escape special characters in the given string of html.
|
46 | *
|
47 | * @param {string} string The string to escape for inserting into HTML
|
48 | * @return {string}
|
49 | * @public
|
50 | */
|
51 |
|
52 | function escapeHtml(string) {
|
53 | var str = '' + string;
|
54 | var match = matchHtmlRegExp.exec(str);
|
55 |
|
56 | if (!match) {
|
57 | return str;
|
58 | }
|
59 |
|
60 | var escape;
|
61 | var html = '';
|
62 | var index = 0;
|
63 | var lastIndex = 0;
|
64 |
|
65 | for (index = match.index; index < str.length; index++) {
|
66 | switch (str.charCodeAt(index)) {
|
67 | case 34:
|
68 | // "
|
69 | escape = '"';
|
70 | break;
|
71 | case 38:
|
72 | // &
|
73 | escape = '&';
|
74 | break;
|
75 | case 39:
|
76 | // '
|
77 | escape = '''; // modified from escape-html; used to be '''
|
78 | break;
|
79 | case 60:
|
80 | // <
|
81 | escape = '<';
|
82 | break;
|
83 | case 62:
|
84 | // >
|
85 | escape = '>';
|
86 | break;
|
87 | default:
|
88 | continue;
|
89 | }
|
90 |
|
91 | if (lastIndex !== index) {
|
92 | html += str.substring(lastIndex, index);
|
93 | }
|
94 |
|
95 | lastIndex = index + 1;
|
96 | html += escape;
|
97 | }
|
98 |
|
99 | return lastIndex !== index ? html + str.substring(lastIndex, index) : html;
|
100 | }
|
101 | // end code copied and modified from escape-html
|
102 |
|
103 | /**
|
104 | * Escapes text to prevent scripting attacks.
|
105 | *
|
106 | * @param {*} text Text value to escape.
|
107 | * @return {string} An escaped string.
|
108 | */
|
109 | function escapeTextContentForBrowser(text) {
|
110 | if (typeof text === 'boolean' || typeof text === 'number') {
|
111 | // this shortcircuit helps perf for types that we know will never have
|
112 | // special characters, especially given that this function is used often
|
113 | // for numeric dom ids.
|
114 | return '' + text;
|
115 | }
|
116 | return escapeHtml(text);
|
117 | }
|
118 |
|
119 | module.exports = escapeTextContentForBrowser; |
\ | No newline at end of file |