1 | /**
|
2 | * Copyright 2016-present, Facebook, Inc.
|
3 | * All rights reserved.
|
4 | *
|
5 | * This source code is licensed under the BSD-style license found in the
|
6 | * LICENSE file in the root directory of this source tree. An additional grant
|
7 | * of patent rights can be found in the PATENTS file in the same directory.
|
8 | *
|
9 | * Based on the escape-html library, which is used under the MIT License below:
|
10 | *
|
11 | * Copyright (c) 2012-2013 TJ Holowaychuk
|
12 | * Copyright (c) 2015 Andreas Lubbe
|
13 | * Copyright (c) 2015 Tiancheng "Timothy" Gu
|
14 | *
|
15 | * Permission is hereby granted, free of charge, to any person obtaining
|
16 | * a copy of this software and associated documentation files (the
|
17 | * 'Software'), to deal in the Software without restriction, including
|
18 | * without limitation the rights to use, copy, modify, merge, publish,
|
19 | * distribute, sublicense, and/or sell copies of the Software, and to
|
20 | * permit persons to whom the Software is furnished to do so, subject to
|
21 | * the following conditions:
|
22 | *
|
23 | * The above copyright notice and this permission notice shall be
|
24 | * included in all copies or substantial portions of the Software.
|
25 | *
|
26 | * THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
|
27 | * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
|
28 | * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
|
29 | * IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
|
30 | * CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
|
31 | * TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
|
32 | * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
|
33 | *
|
34 | */
|
35 |
|
36 | ;
|
37 |
|
38 | // code copied and modified from escape-html
|
39 | /**
|
40 | * Module variables.
|
41 | * @private
|
42 | */
|
43 |
|
44 | var matchHtmlRegExp = /["'&<>]/;
|
45 |
|
46 | /**
|
47 | * Escape special characters in the given string of html.
|
48 | *
|
49 | * @param {string} string The string to escape for inserting into HTML
|
50 | * @return {string}
|
51 | * @public
|
52 | */
|
53 |
|
54 | function escapeHtml(string) {
|
55 | var str = '' + string;
|
56 | var match = matchHtmlRegExp.exec(str);
|
57 |
|
58 | if (!match) {
|
59 | return str;
|
60 | }
|
61 |
|
62 | var escape;
|
63 | var html = '';
|
64 | var index = 0;
|
65 | var lastIndex = 0;
|
66 |
|
67 | for (index = match.index; index < str.length; index++) {
|
68 | switch (str.charCodeAt(index)) {
|
69 | case 34:
|
70 | // "
|
71 | escape = '"';
|
72 | break;
|
73 | case 38:
|
74 | // &
|
75 | escape = '&';
|
76 | break;
|
77 | case 39:
|
78 | // '
|
79 | escape = '''; // modified from escape-html; used to be '''
|
80 | break;
|
81 | case 60:
|
82 | // <
|
83 | escape = '<';
|
84 | break;
|
85 | case 62:
|
86 | // >
|
87 | escape = '>';
|
88 | break;
|
89 | default:
|
90 | continue;
|
91 | }
|
92 |
|
93 | if (lastIndex !== index) {
|
94 | html += str.substring(lastIndex, index);
|
95 | }
|
96 |
|
97 | lastIndex = index + 1;
|
98 | html += escape;
|
99 | }
|
100 |
|
101 | return lastIndex !== index ? html + str.substring(lastIndex, index) : html;
|
102 | }
|
103 | // end code copied and modified from escape-html
|
104 |
|
105 | /**
|
106 | * Escapes text to prevent scripting attacks.
|
107 | *
|
108 | * @param {*} text Text value to escape.
|
109 | * @return {string} An escaped string.
|
110 | */
|
111 | function escapeTextContentForBrowser(text) {
|
112 | if (typeof text === 'boolean' || typeof text === 'number') {
|
113 | // this shortcircuit helps perf for types that we know will never have
|
114 | // special characters, especially given that this function is used often
|
115 | // for numeric dom ids.
|
116 | return '' + text;
|
117 | }
|
118 | return escapeHtml(text);
|
119 | }
|
120 |
|
121 | module.exports = escapeTextContentForBrowser; |
\ | No newline at end of file |