|
|
@@ -901,20 +901,30 @@ var Utils = {
|
|
|
|
|
|
|
|
|
/**
|
|
|
- * Escapes HTML tags in a string to stop them being rendered
|
|
|
+ * Escapes HTML tags in a string to stop them being rendered.
|
|
|
+ * https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet
|
|
|
*
|
|
|
* @param {string} str
|
|
|
* @returns string
|
|
|
*
|
|
|
* @example
|
|
|
- * // return "A <script> tag"
|
|
|
+ * // return "A <script> tag"
|
|
|
* Utils.escapeHtml("A <script> tag");
|
|
|
*/
|
|
|
escapeHtml: function(str) {
|
|
|
- return str.replace(/</g, "<")
|
|
|
- .replace(/'/g, "'")
|
|
|
- .replace(/"/g, """)
|
|
|
- .replace(/&/g, "&");
|
|
|
+ var HTML_CHARS = {
|
|
|
+ "&": "&",
|
|
|
+ "<": "<",
|
|
|
+ ">": ">",
|
|
|
+ '"': """,
|
|
|
+ "'": "'", // ' not recommended because it's not in the HTML spec
|
|
|
+ "/": "/", // forward slash is included as it helps end an HTML entity
|
|
|
+ "`": "`"
|
|
|
+ };
|
|
|
+
|
|
|
+ return str.replace(/[&<>"'\/`]/g, function (match) {
|
|
|
+ return HTML_CHARS[match];
|
|
|
+ });
|
|
|
},
|
|
|
|
|
|
|
n1474335