source: trip-planner-front/node_modules/html-escaper/README.md@ 6a3a178

Last change on this file since 6a3a178 was 6a3a178, checked in by Ema <ema_spirova@…>, 3 years ago

initial commit

  • Property mode set to 100644
File size: 4.2 KB
Line 
1# html-escaper [![Build Status](https://travis-ci.org/WebReflection/html-escaper.svg?branch=master)](https://travis-ci.org/WebReflection/html-escaper) [![Coverage Status](https://coveralls.io/repos/github/WebReflection/html-escaper/badge.svg?branch=master)](https://coveralls.io/github/WebReflection/html-escaper?branch=master)
2A simple module to escape/unescape common problematic entities.
3
4
5### How
6This package is available in npm so `npm install html-escaper` is all you need to do, using eventually the global flag too.
7
8Once the module is present
9```js
10var html = require('html-escaper');
11
12// two basic methods
13html.escape('string');
14html.unescape('escaped string');
15```
16
17
18### Why
19there is basically one rule only: do not **ever** replace one char after another if you are transforming a string into another.
20
21```js
22// WARNING: THIS IS WRONG
23// if you are that kind of dev that does this
24function escape(s) {
25 return s.replace(/&/g, "&amp;")
26 .replace(/</g, "&lt;")
27 .replace(/>/g, "&gt;")
28 .replace(/'/g, "&#39;")
29 .replace(/"/g, "&quot;");
30}
31
32// you might be the same dev that does this too
33function unescape(s) {
34 return s.replace(/&amp;/g, "&")
35 .replace(/&lt;/g, "<")
36 .replace(/&gt;/g, ">")
37 .replace(/&#39;/g, "'")
38 .replace(/&quot;/g, '"');
39}
40
41// guess what we have here ?
42unescape('&amp;lt;');
43
44// now guess this XSS too ...
45unescape('&amp;lt;script&amp;gt;alert("yo")&amp;lt;/script&amp;gt;');
46
47
48```
49
50The last example will produce `<script>alert("yo")</script>` instead of the expected `&lt;script&gt;alert("yo")&lt;/script&gt;`.
51
52Nothing like this could possibly happen if we grab all chars at once and either ways.
53It's just a fortunate case that after swapping `&` with `&amp;` no other replace will be affected, but it's not portable and universally a bad practice.
54
55Grab all chars at once, no excuses!
56
57
58
59**more details**
60As somebody might think it's an `unescape` issue only, it's not. Being an anti-pattern with side effects works both ways.
61
62As example, changing the order of the replacement in escaping would produce the unexpected:
63```js
64function escape(s) {
65 return s.replace(/</g, "&lt;")
66 .replace(/>/g, "&gt;")
67 .replace(/'/g, "&#39;")
68 .replace(/"/g, "&quot;")
69 .replace(/&/g, "&amp;");
70}
71
72escape('<'); // &amp;lt; instead of &lt;
73```
74If we do not want to code with the fear that the order wasn't perfect or that our order in either escaping or unescaping is different from the order another method or function used, if we understand the issue and we agree it's potentially a disaster prone approach, if we add the fact in this case creating 4 RegExp objects each time and invoking 4 times `.replace` trough the `String.prototype` is also potentially slower than creating one function only holding one object, or holding the function too, we should agree there is not absolutely any valid reason to keep proposing a char-by-char implementation.
75
76We have proofs this approach can fail already so ... why should we risk? Just avoid and grab all chars at once or simply use this tiny utility.
77
78### Backtick
79Internt explorer < 9 has [some backtick issue](https://html5sec.org/#102)
80
81For compatibility sake with common server-side HTML entities encoders and decoders, and in order to have the most reliable I/O, this little utility will NOT fix this IE < 9 problem.
82
83It is also important to note that if we create valid HTML and we set attributes at runtime through this utility, backticks in strings cannot possibly affect attribute behaviors.
84
85```js
86var img = new Image();
87img.src = html.escape(
88 'x` `<script>alert(1)</script>"` `'
89);
90// it won't cause problems even in IE < 9
91```
92
93**However**, if you use `innerHTML` and you target IE < 9 then [this **might** be a problem](https://github.com/nette/nette/issues/1496).
94
95Accordingly, if you need more chars and/or backticks to be escaped and unescaped, feel free to use alternatives like [lodash](https://github.com/lodash/lodash) or [he](https://www.npmjs.com/package/he)
96
97Here a bit more of [my POV](https://github.com/WebReflection/html-escaper/commit/52d554fc6e8583b6ffdd357967cf71962fc07cf6#commitcomment-10625122) and why I haven't implemented same thing alternatives did. Good news: those are alternatives ;-)
Note: See TracBrowser for help on using the repository browser.