Skip to content

Commit

Permalink
revert: escape backtick
Browse files Browse the repository at this point in the history
  • Loading branch information
gurgunday committed Aug 3, 2024
1 parent 4a5cf95 commit 0f6b035
Show file tree
Hide file tree
Showing 3 changed files with 87 additions and 92 deletions.
2 changes: 1 addition & 1 deletion README.md
Original file line number Diff line number Diff line change
Expand Up @@ -213,4 +213,4 @@ summary for Real World Scenario
## Security
Like [similar tools](https://handlebarsjs.com/guide/#html-escaping), ghtml does not prevent all kinds of XSS attacks. It is the responsibility of developers to sanitize user inputs. Some inherently insecure uses include dynamically generating JavaScript, failing to quote HTML attribute values (especially when they contain expressions), and relying on unsanitized user-provided URIs.
Like [similar tools](https://handlebarsjs.com/guide/#html-escaping), ghtml does not prevent all kinds of XSS attacks. It is the responsibility of developers to sanitize user inputs. Some inherently insecure uses include dynamically generating JavaScript, failing to quote HTML attribute values, and relying on unsanitized user-provided URIs.
6 changes: 1 addition & 5 deletions src/html.js
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
const escapeRegExp = /["&'<=>`]/;
const escapeRegExp = /["&'<=>]/;

const escapeFunction = (string) => {
let escaped = "";
Expand Down Expand Up @@ -30,10 +30,6 @@ const escapeFunction = (string) => {
escaped += string.slice(start, end) + "&#62;";
start = end + 1;
continue;
case 96: // `
escaped += string.slice(start, end) + "&#96;";
start = end + 1;
continue;
}
}

Expand Down
Loading

0 comments on commit 0f6b035

Please sign in to comment.