@contentful/rich-text-html-renderer - npm Package Compare versions

Comparing version 12.1.0 to 12.1.2

dist/lib/__test__/index.test.js

@@ -85,2 +85,46 @@ "use strict";
     });
+    it('renders escaped html', function () {
+        var document = {
+            nodeType: rich_text_types_1.BLOCKS.DOCUMENT,
+            data: {},
+            content: [
+                {
+                    nodeType: rich_text_types_1.BLOCKS.PARAGRAPH,
+                    data: {},
+                    content: [
+                        {
+                            nodeType: 'text',
+                            value: 'foo & bar',
+                            marks: [],
+                            data: {},
+                        },
+                    ],
+                },
+            ],
+        };
+        var expected = '<p>foo &amp; bar</p>';
+        expect(index_1.documentToHtmlString(document)).toEqual(expected);
+    });
+    it('renders escaped html with marks', function () {
+        var document = {
+            nodeType: rich_text_types_1.BLOCKS.DOCUMENT,
+            data: {},
+            content: [
+                {
+                    nodeType: rich_text_types_1.BLOCKS.PARAGRAPH,
+                    data: {},
+                    content: [
+                        {
+                            nodeType: 'text',
+                            value: 'foo & bar',
+                            marks: [{ type: rich_text_types_1.MARKS.UNDERLINE }, { type: rich_text_types_1.MARKS.BOLD }],
+                            data: {},
+                        },
+                    ],
+                },
+            ],
+        };
+        var expected = '<p><b><u>foo &amp; bar</u></b></p>';
+        expect(index_1.documentToHtmlString(document)).toEqual(expected);
+    });
     it('does not render unrecognized marks', function () {
@@ -87,0 +131,0 @@ var document = documents_1.invalidMarksDoc;

dist/lib/index.js

 "use strict";
-var __assign = (this && this.__assign) || Object.assign || function(t) {
-    for (var s, i = 1, n = arguments.length; i < n; i++) {
-        s = arguments[i];
-        for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
-            t[p] = s[p];
-    }
-    return t;
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
 };
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 var _a, _b;
+var escape_html_1 = __importDefault(require("escape-html"));
 var rich_text_types_1 = require("@contentful/rich-text-types");
@@ -59,2 +66,3 @@ var defaultNodeRenderers = (_a = {},
     if (rich_text_types_1.helpers.isText(node)) {
+        var nodeValue = escape_html_1.default(node.value);
         if (node.marks.length > 0) {
@@ -66,5 +74,5 @@ return node.marks.reduce(function (value, mark) {
                 return renderMark[mark.type](value);
-            }, node.value);
+            }, nodeValue);
         }
-        return node.value;
+        return nodeValue;
     }
@@ -71,0 +79,0 @@ else {

dist/rich-text-html-renderer.es5.js

@@ -31,2 +31,79 @@ 'use strict';
 
+/*!
+ * escape-html
+ * Copyright(c) 2012-2013 TJ Holowaychuk
+ * Copyright(c) 2015 Andreas Lubbe
+ * Copyright(c) 2015 Tiancheng "Timothy" Gu
+ * MIT Licensed
+ */
+
+/**
+ * Module variables.
+ * @private
+ */
+
+var matchHtmlRegExp = /["'&<>]/;
+
+/**
+ * Module exports.
+ * @public
+ */
+
+var escapeHtml_1 = escapeHtml;
+
+/**
+ * Escape special characters in the given string of html.
+ *
+ * @param  {string} string The string to escape for inserting into HTML
+ * @return {string}
+ * @public
+ */
+
+function escapeHtml(string) {
+  var str = '' + string;
+  var match = matchHtmlRegExp.exec(str);
+
+  if (!match) {
+    return str;
+  }
+
+  var escape;
+  var html = '';
+  var index = 0;
+  var lastIndex = 0;
+
+  for (index = match.index; index < str.length; index++) {
+    switch (str.charCodeAt(index)) {
+      case 34: // "
+        escape = '&quot;';
+        break;
+      case 38: // &
+        escape = '&amp;';
+        break;
+      case 39: // '
+        escape = '&#39;';
+        break;
+      case 60: // <
+        escape = '&lt;';
+        break;
+      case 62: // >
+        escape = '&gt;';
+        break;
+      default:
+        continue;
+    }
+
+    if (lastIndex !== index) {
+      html += str.substring(lastIndex, index);
+    }
+
+    lastIndex = index + 1;
+    html += escape;
+  }
+
+  return lastIndex !== index
+    ? html + str.substring(lastIndex, index)
+    : html;
+}
+
 function unwrapExports (x) {
@@ -607,2 +684,3 @@ return x && x.__esModule && Object.prototype.hasOwnProperty.call(x, 'default') ? x.default : x;
     if (richTextTypes_es5_1.isText(node)) {
+        var nodeValue = escapeHtml_1(node.value);
         if (node.marks.length > 0) {
@@ -614,5 +692,5 @@ return node.marks.reduce(function (value, mark) {
                 return renderMark[mark.type](value);
-            }, node.value);
+            }, nodeValue);
         }
-        return node.value;
+        return nodeValue;
     }
@@ -619,0 +697,0 @@ else {

package.json

 {
   "name": "@contentful/rich-text-html-renderer",
-  "version": "12.1.0",
+  "version": "12.1.2",
   "main": "dist/rich-text-html-renderer.es5.js",
@@ -26,5 +26,7 @@ "typings": "dist/types/index.d.ts",
   "dependencies": {
-    "@contentful/rich-text-types": "^12.0.1"
+    "@contentful/rich-text-types": "^12.1.2",
+    "escape-html": "^1.0.3"
   },
   "devDependencies": {
+    "@types/escape-html": "0.0.20",
     "jest": "^23.6.0",
@@ -39,5 +41,5 @@ "rimraf": "^2.6.2",
     "ts-jest": "^23.10.4",
-    "typescript": "^2.9.2"
+    "typescript": "^3.2.2"
   },
-  "gitHead": "28b1e778dd929ac15d6b19ff87015c30c4d5e5b6"
+  "gitHead": "8cf8bb70502ae01ca8c4b88db96f421ad8a25d24"
 }

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

118288

increased by6.48%

Lines of code

1418

increased by8.99%

Worsened metrics

Dependency count

2

increased by100%

Dev dependency count

11

increased by10%

Dependency changes

• + Addedescape-html@^1.0.3

• + Addedescape-html@1.0.3(transitive)

• Updated@contentful/rich-text-types@^12.1.2