mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-11-14 00:01:03 +00:00
Maurice
a965b2c75e
isomorphic-dompurify builds a jsdom window as soon as it loads on Node, and the root barrel is what the server and each of its ~900 test files import, so every one of them loaded jsdom without ever sanitising. The sanitisers move behind @trek/shared/sanitize (a build entry of its own, like roadtrip), escapeHtml stays in the root from its own module, and the client's translation context imports the sanitiser from the subpath. The production server stops loading jsdom at boot as well.
17 lines
590 B
TypeScript
17 lines
590 B
TypeScript
/**
|
|
* Escapes the five HTML metacharacters so a raw string can be safely
|
|
* interpolated into an HTML template. Use this BEFORE substitution when a
|
|
* user-controlled value lands inside a markup-shaped translation string.
|
|
*
|
|
* This is *not* a substitute for `sanitizeInlineHtml`: escape input, then
|
|
* sanitise the resulting template — both layers run together in `tHtml`.
|
|
*/
|
|
export function escapeHtml(value: string): string {
|
|
return value
|
|
.replace(/&/g, '&')
|
|
.replace(/</g, '<')
|
|
.replace(/>/g, '>')
|
|
.replace(/"/g, '"')
|
|
.replace(/'/g, ''');
|
|
}
|