| 1 | /** |
| 2 | * Copyright (c) Meta Platforms, Inc. and affiliates. |
| 3 | * |
| 4 | * This source code is licensed under the MIT license found in the |
| 5 | * LICENSE file in the root directory of this source tree. |
| 6 | * |
| 7 | * Based on the escape-html library, which is used under the MIT License below: |
| 8 | * |
| 9 | * Copyright (c) 2012-2013 TJ Holowaychuk |
| 10 | * Copyright (c) 2015 Andreas Lubbe |
| 11 | * Copyright (c) 2015 Tiancheng "Timothy" Gu |
| 12 | * |
| 13 | * Permission is hereby granted, free of charge, to any person obtaining |
| 14 | * a copy of this software and associated documentation files (the |
| 15 | * 'Software'), to deal in the Software without restriction, including |
| 16 | * without limitation the rights to use, copy, modify, merge, publish, |
| 17 | * distribute, sublicense, and/or sell copies of the Software, and to |
| 18 | * permit persons to whom the Software is furnished to do so, subject to |
| 19 | * the following conditions: |
| 20 | * |
| 21 | * The above copyright notice and this permission notice shall be |
| 22 | * included in all copies or substantial portions of the Software. |
| 23 | * |
| 24 | * THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND, |
| 25 | * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF |
| 26 | * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. |
| 27 | * IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY |
| 28 | * CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, |
| 29 | * TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE |
| 30 | * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. |
| 31 | * |
| 32 | * @flow |
| 33 | */ |
| 34 | |
| 35 | // code copied and modified from escape-html |
| 36 | /** |
| 37 | * Module variables. |
| 38 | * @private |
| 39 | */ |
| 40 | |
| 41 | import {checkHtmlStringCoercion} from 'shared/CheckStringCoercion'; |
| 42 | |
| 43 | const matchHtmlRegExp = /["'&<>]/; |
| 44 | |
| 45 | /** |
| 46 | * Escapes special characters and HTML entities in a given html string. |
| 47 | * |
| 48 | * @param {string} string HTML string to escape for later insertion |
| 49 | * @return {string} |
| 50 | * @public |
| 51 | */ |
| 52 | |
| 53 | function escapeHtml(string: string) { |
| 54 | if (__DEV__) { |
| 55 | checkHtmlStringCoercion(string); |
| 56 | } |
| 57 | const str = '' + string; |
| 58 | const match = matchHtmlRegExp.exec(str); |
| 59 | |
| 60 | if (!match) { |
| 61 | return str; |
| 62 | } |
| 63 | |
| 64 | let escape; |
| 65 | let html = ''; |
| 66 | let index; |
| 67 | let lastIndex = 0; |
| 68 | |
| 69 | for (index = match.index; index < str.length; index++) { |
| 70 | switch (str.charCodeAt(index)) { |
| 71 | case 34: // " |
| 72 | escape = '"'; |
| 73 | break; |
| 74 | case 38: // & |
| 75 | escape = '&'; |
| 76 | break; |
| 77 | case 39: // ' |
| 78 | escape = '''; // modified from escape-html; used to be ''' |
| 79 | break; |
| 80 | case 60: // < |
| 81 | escape = '<'; |
| 82 | break; |
| 83 | case 62: // > |
| 84 | escape = '>'; |
| 85 | break; |
| 86 | default: |
| 87 | continue; |
| 88 | } |
| 89 | |
| 90 | if (lastIndex !== index) { |
| 91 | html += str.slice(lastIndex, index); |
| 92 | } |
| 93 | |
| 94 | lastIndex = index + 1; |
| 95 | html += escape; |
| 96 | } |
| 97 | |
| 98 | return lastIndex !== index ? html + str.slice(lastIndex, index) : html; |
| 99 | } |
| 100 | // end code copied and modified from escape-html |
| 101 | |
| 102 | /** |
| 103 | * Escapes text to prevent scripting attacks. |
| 104 | * |
| 105 | * @param {*} text Text value to escape. |
| 106 | * @return {string} An escaped string. |
| 107 | */ |
| 108 | function escapeTextForBrowser(text: string | number | boolean): string { |
| 109 | if ( |
| 110 | typeof text === 'boolean' || |
| 111 | typeof text === 'number' || |
| 112 | typeof text === 'bigint' |
| 113 | ) { |
| 114 | // this shortcircuit helps perf for types that we know will never have |
| 115 | // special characters, especially given that this function is used often |
| 116 | // for numeric dom ids. |
| 117 | return '' + (text as any); |
| 118 | } |
| 119 | return escapeHtml(text); |
| 120 | } |
| 121 | |
| 122 | export default escapeTextForBrowser; |