|
/** |
|
* Replaces " to &qquot; |
|
* @param {String} value |
|
*/ |
|
const escapeHTML = (value) => value |
|
.replace(/&/g, '&') |
|
.replace(/</g, '<') |
|
.replace(/>/g, '>') |
|
.replace(/"/g, '"') |
|
.replace(/'/g, ''') |
|
// eslint-disable-next-line no-script-url |
|
.replace(/(javascript|data|vbscript):/gi, '$1%3A'); |
The name escapeHTML suggests, that the method may be used to sanitize text-content and get rid of probably malicious nested HTML in BBCode, like [i]<script>javascript:alert("XSS!"</script>[/i]. Unfortunately, the method has an extra turn, to support escaping of probably unsafe href attributes: It also escapes problematic protocols assuming, we are in a URL-context.
Thus, naively reused in custom API the above will escape the text content to:
<script>javascript%3Aalert... (etc.)
The suggestion for clarity is to name the method escapeHTMLAttribute or, as this is considered breaking, at least mention this usage in the JSdoc.
Otherwise, I think the best option for escaping (and I tend to switch to it) is to rely on DOM processing as suggested in #148 (comment).
BBob/packages/bbob-plugin-helper/src/helpers.js
Lines 28 to 39 in 3575982
The name
escapeHTMLsuggests, that the method may be used to sanitize text-content and get rid of probably malicious nested HTML in BBCode, like[i]<script>javascript:alert("XSS!"</script>[/i]. Unfortunately, the method has an extra turn, to support escaping of probably unsafehrefattributes: It also escapes problematic protocols assuming, we are in a URL-context.Thus, naively reused in custom API the above will escape the text content to:
The suggestion for clarity is to name the method
escapeHTMLAttributeor, as this is considered breaking, at least mention this usage in the JSdoc.Otherwise, I think the best option for escaping (and I tend to switch to it) is to rely on DOM processing as suggested in #148 (comment).