mirrors/CyberChef
1
0
Fork 0
mirror of https://github.com/gchq/CyberChef.git synced 2025-04-21 15:26:16 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fixed double encoding of HTML entities by improving Utils.escapeHTML. Fixes #76.

Browse source
This commit is contained in:
n1474335 2017-02-10 16:39:32 +00:00
parent 0e2ce2bee2
commit f76316eae3
6 changed files with 31 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

22
src/js/core/Utils.js
View file

@ -901,20 +901,30 @@ var Utils = {
/**
* Escapes HTML tags in a string to stop them being rendered
* Escapes HTML tags in a string to stop them being rendered.
* https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet
*
* @param {string} str
* @returns string
*
* @example
* // return "A <script> tag"
* // return "A <script> tag"
* Utils.escapeHtml("A <script> tag");
*/
escapeHtml: function(str) {
return str.replace(/</g, "&lt;")
.replace(/'/g, "&apos;")
.replace(/"/g, "&quot;")
.replace(/&/g, "&amp;");
var HTML_CHARS = {
"&": "&amp;",
"<": "&lt;",
">": "&gt;",
'"': "&quot;",
"'": "&#x27;", // &apos; not recommended because it's not in the HTML spec
"/": "&#x2F;", // forward slash is included as it helps end an HTML entity
"`": "&#x60;"
};
return str.replace(/[&<>"'\/`]/g, function (match) {
return HTML_CHARS[match];
});
},