| 1 | /** |
| 2 | * Copyright (c) Meta Platforms, Inc. and affiliates. |
| 3 | * |
| 4 | * This source code is licensed under the MIT license found in the |
| 5 | * LICENSE file in the root directory of this source tree. |
| 6 | * |
| 7 | * @flow |
| 8 | */ |
| 9 | |
| 10 | // When passing user input into querySelector(All) the embedded string must not alter |
| 11 | // the semantics of the query. This escape function is safe to use when we know the |
| 12 | // provided value is going to be wrapped in double quotes as part of an attribute selector |
| 13 | // Do not use it anywhere else |
| 14 | // we escape double quotes and backslashes |
| 15 | const escapeSelectorAttributeValueInsideDoubleQuotesRegex = /[\n\"\\]/g; |
| 16 | export default function escapeSelectorAttributeValueInsideDoubleQuotes( |
| 17 | value: string, |
| 18 | ): string { |
| 19 | return value.replace( |
| 20 | escapeSelectorAttributeValueInsideDoubleQuotesRegex, |
| 21 | ch => '\\' + ch.charCodeAt(0).toString(16) + ' ', |
| 22 | ); |
| 23 | } |