{
"manifest": {
"name": "html-escaper",
"version": "2.0.2",
"description": "fast and safe way to escape and unescape &<>'\" chars",
"main": "./cjs/index.js",
"unpkg": "min.js",
"scripts": {
"build": "npm run cjs && npm run rollup && npm run minify && npm test && npm run size",
"cjs": "ascjs esm cjs",
"coveralls": "cat ./coverage/lcov.info | coveralls",
"minify": "uglifyjs index.js --comments=/^!/ --compress --mangle -o min.js",
"rollup": "rollup --config rollup.config.js",
"size": "cat index.js | wc -c;cat min.js | wc -c;gzip -c min.js | wc -c",
"test": "istanbul cover ./test/index.js"
},
"module": "./esm/index.js",
"repository": {
"type": "git",
"url": "https://github.com/WebReflection/html-escaper.git"
},
"keywords": [
"html",
"escape",
"encode",
"unescape",
"decode",
"entities"
],
"author": {
"name": "Andrea Giammarchi"
},
"license": "MIT",
"bugs": {
"url": "https://github.com/WebReflection/html-escaper/issues"
},
"homepage": "https://github.com/WebReflection/html-escaper",
"devDependencies": {
"ascjs": "^3.1.2",
"coveralls": "^3.0.11",
"istanbul": "^0.4.5",
"rollup": "^2.1.0",
"uglify-js": "^3.8.0"
},
"_registry": "npm",
"_loc": "/homez.1033/heliovt/.cache/yarn/v6/npm-html-escaper-2.0.2-dfd60027da36a36dfcbe236262c00a5822681453-integrity/node_modules/html-escaper/package.json",
"readmeFilename": "README.md",
"readme": "# html-escaper [](https://travis-ci.org/WebReflection/html-escaper) [](https://coveralls.io/github/WebReflection/html-escaper?branch=master)\nA simple module to escape/unescape common problematic entities.\n\n\n### How\nThis package is available in npm so `npm install html-escaper` is all you need to do, using eventually the global flag too.\n\nOnce the module is present\n```js\nvar html = require('html-escaper');\n\n// two basic methods\nhtml.escape('string');\nhtml.unescape('escaped string');\n```\n\n\n### Why\nthere is basically one rule only: do not **ever** replace one char after another if you are transforming a string into another.\n\n```js\n// WARNING: THIS IS WRONG\n// if you are that kind of dev that does this\nfunction escape(s) {\n return s.replace(/&/g, \"&\")\n .replace(//g, \">\")\n .replace(/'/g, \"'\")\n .replace(/\"/g, \""\");\n}\n\n// you might be the same dev that does this too\nfunction unescape(s) {\n return s.replace(/&/g, \"&\")\n .replace(/</g, \"<\")\n .replace(/>/g, \">\")\n .replace(/'/g, \"'\")\n .replace(/"/g, '\"');\n}\n\n// guess what we have here ?\nunescape('<');\n\n// now guess this XSS too ...\nunescape('<script>alert(\"yo\")</script>');\n\n\n```\n\nThe last example will produce `` instead of the expected `<script>alert(\"yo\")</script>`.\n\nNothing like this could possibly happen if we grab all chars at once and either ways.\nIt's just a fortunate case that after swapping `&` with `&` no other replace will be affected, but it's not portable and universally a bad practice.\n\nGrab all chars at once, no excuses!\n\n\n\n**more details**\nAs somebody might think it's an `unescape` issue only, it's not. Being an anti-pattern with side effects works both ways.\n\nAs example, changing the order of the replacement in escaping would produce the unexpected:\n```js\nfunction escape(s) {\n return s.replace(//g, \">\")\n .replace(/'/g, \"'\")\n .replace(/\"/g, \""\")\n .replace(/&/g, \"&\");\n}\n\nescape('<'); // < instead of <\n```\nIf we do not want to code with the fear that the order wasn't perfect or that our order in either escaping or unescaping is different from the order another method or function used, if we understand the issue and we agree it's potentially a disaster prone approach, if we add the fact in this case creating 4 RegExp objects each time and invoking 4 times `.replace` trough the `String.prototype` is also potentially slower than creating one function only holding one object, or holding the function too, we should agree there is not absolutely any valid reason to keep proposing a char-by-char implementation.\n\nWe have proofs this approach can fail already so ... why should we risk? Just avoid and grab all chars at once or simply use this tiny utility.\n\n### Backtick\nInternt explorer < 9 has [some backtick issue](https://html5sec.org/#102)\n\nFor compatibility sake with common server-side HTML entities encoders and decoders, and in order to have the most reliable I/O, this little utility will NOT fix this IE < 9 problem.\n\nIt is also important to note that if we create valid HTML and we set attributes at runtime through this utility, backticks in strings cannot possibly affect attribute behaviors.\n\n```js\nvar img = new Image();\nimg.src = html.escape(\n 'x` `\"` `'\n);\n// it won't cause problems even in IE < 9\n```\n\n**However**, if you use `innerHTML` and you target IE < 9 then [this **might** be a problem](https://github.com/nette/nette/issues/1496).\n\nAccordingly, if you need more chars and/or backticks to be escaped and unescaped, feel free to use alternatives like [lodash](https://github.com/lodash/lodash) or [he](https://www.npmjs.com/package/he)\n\nHere a bit more of [my POV](https://github.com/WebReflection/html-escaper/commit/52d554fc6e8583b6ffdd357967cf71962fc07cf6#commitcomment-10625122) and why I haven't implemented same thing alternatives did. Good news: those are alternatives ;-)",
"licenseText": "Copyright (C) 2017-present by Andrea Giammarchi - @WebReflection\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in\nall copies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN\nTHE SOFTWARE.\n"
},
"artifacts": [],
"remote": {
"resolved": "https://registry.yarnpkg.com/html-escaper/-/html-escaper-2.0.2.tgz#dfd60027da36a36dfcbe236262c00a5822681453",
"type": "tarball",
"reference": "https://registry.yarnpkg.com/html-escaper/-/html-escaper-2.0.2.tgz",
"hash": "dfd60027da36a36dfcbe236262c00a5822681453",
"integrity": "sha512-H2iMtd0I4Mt5eYiapRdIDjp+XzelXQ0tFE4JS7YFwFevXXMmOp9myNrUvCg0D6ws8iqkRPBfKHgbwig1SmlLfg==",
"registry": "npm",
"packageName": "html-escaper",
"cacheIntegrity": "sha512-H2iMtd0I4Mt5eYiapRdIDjp+XzelXQ0tFE4JS7YFwFevXXMmOp9myNrUvCg0D6ws8iqkRPBfKHgbwig1SmlLfg== sha1-39YAJ9o2o238viNiYsAKWCJoFFM="
},
"registry": "npm",
"hash": "dfd60027da36a36dfcbe236262c00a5822681453"
}