feat: enhance HTML escaping to include single quotes (#4755)
Signed| @@ -140,8 +140,18 @@ export function ensurePlainObject(obj) { | ||
| 140 | 140 | return obj; |
| 141 | 141 | } |
| 142 | 142 | |
| 143 | +/** | |
| 144 | + * Escapes text for safe HTML rendering. | |
| 145 | + * @param {string?} str | |
| 146 | + * @returns {string} | |
| 147 | + */ | |
| 143 | 148 | export function escapeHtml(str) { |
| 144 | - return String(str).replace(/&/g, '&').replace(/</g, '<').replace(/>/g, '>').replace(/"/g, '"'); | |
| 149 | + return String(str ?? '') | |
| 150 | + .replace(/&/g, '&') | |
| 151 | + .replace(/</g, '<') | |
| 152 | + .replace(/>/g, '>') | |
| 153 | + .replace(/"/g, '"') | |
| 154 | + .replace(/'/g, '''); | |
| 145 | 155 | } |
| 146 | 156 | |
| 147 | 157 | /** |