'use strict'; require('raptor-polyfill/string/startsWith'); var warp10 = require('warp10'); var extend = require('raptor-util/extend'); var STYLE_ATTR = 'style'; var CLASS_ATTR = 'class'; var escapeEndingScriptTagRegExp = /<\//g; var elTest = /[&<]/; var elTestReplace = /[&<]/g; var attrTest = /[&<\"\n]/; var attrReplace = /[&<\"\n]/g; var stringifiedAttrTest = /[&\'\n]/; var stringifiedAttrReplace = /[&\'\n]/g; var classList; var replacements = { '<': '<', '&': '&', '"': '"', '\'': ''', '\n': ' ' //Preserve new lines so that they don't get normalized as space }; function replaceChar(match) { return replacements[match]; } function escapeStr(str, regexpTest, regexpReplace) { return regexpTest.test(str) ? str.replace(regexpReplace, replaceChar) : str; } function escapeXmlHelper(value, regexpTest, regexpReplace) { // check for most common case first if (typeof value === 'string') { return escapeStr(value, regexpTest, regexpReplace); } else if (value == null) { return ''; } else if (typeof value === 'object') { var safeHTML = value.safeHTML; if (safeHTML != null) { return value.safeHTML; } else { return ''; } } else if (value === true || value === false || typeof value === 'number') { return value.toString(); } return escapeStr(value.toString(), regexpTest, regexpReplace); } function escapeXml(value) { return escapeXmlHelper(value, elTest, elTestReplace); } function escapeXmlAttr(value) { return escapeXmlHelper(value, attrTest, attrReplace); } function attr(name, value, shouldEscape) { if (typeof value === 'string') { return ' ' + name + '="' + (shouldEscape !== false ? escapeStr(value, attrTest, attrReplace) : value) + '"'; } else if (value === true) { return ' ' + name; } else if (value == null || value === false) { return ''; } else if (typeof value === 'object') { if (name.startsWith('data-_')) { value = warp10.stringify(value); } else { value = JSON.stringify(value); } return ' ' + name + "='" + escapeStr(value, stringifiedAttrTest, stringifiedAttrReplace) + "'"; } else { return ' ' + name + '=' + value; // number (doesn't need quotes) } } /** * Internal method to escape special XML characters * @private */ exports.x = escapeXml; /** * Internal method to escape special XML characters within an attribute * @private */ exports.xa = escapeXmlAttr; /** * Escapes the ' body to avoid the `' * }; * * * * Without escaping the ending '' sequence the opening