Security News
GitHub Removes Malicious Pull Requests Targeting Open Source Repositories
GitHub removed 27 malicious pull requests attempting to inject harmful code across multiple open source repositories, in another round of low-effort attacks.
escape-goat
Advanced tools
The escape-goat package is a utility for escaping and unescaping HTML entities in strings. It is useful for preventing XSS attacks by sanitizing user input or rendering text in a web application.
Escape HTML
Escapes HTML entities in a string to prevent XSS attacks or render text safely in HTML documents. The code sample demonstrates how to escape a string containing HTML tags and entities.
"<div>Hello & 'world'</div>".escape()
Unescape HTML
Unescapes HTML entities in a string. This is useful when you need to convert sanitized text back to its original form for editing or processing. The code sample shows how to unescape a string that contains escaped HTML entities.
"<div>Hello & 'world'</div>".unescape()
The 'he' package is a robust HTML entity encoder/decoder written in JavaScript. It supports all named character references defined in HTML, handling even obscure and rare entities. Compared to escape-goat, 'he' offers a more comprehensive set of features for encoding and decoding HTML entities.
The 'escape-html' package is a simple and fast utility for escaping HTML entities in strings. It is focused solely on escaping strings to prevent XSS attacks, similar to escape-goat's escaping functionality, but does not provide unescaping capabilities.
The 'entities' package is a comprehensive library for encoding and decoding HTML/XML entities. It offers a wide range of functionalities, including support for numerous character encodings. It is more feature-rich compared to escape-goat, which has a more minimalistic approach.
Escape a string for use in HTML or the inverse
$ npm install escape-goat
const escapeGoat = require('escape-goat');
escapeGoat.escape('🦄 & 🐐');
//=> '🦄 & 🐐'
escapeGoat.unescape('🦄 & 🐐');
//=> '🦄 & 🐐'
escapeGoat.escape('Hello <em>World</em>');
//=> 'Hello <em>World</em>'
Escapes the following characters in the given input
string: &
<
>
"
'
Unescapes the following HTML entities in the given input
string: &
<
>
"
'
Ensure you always quote your HTML attributes to prevent possible XSS.
I couldn't find one I liked that was tiny, well-tested, and had both .escape()
and .unescape()
.
MIT © Sindre Sorhus
FAQs
Escape a string for use in HTML or the inverse
The npm package escape-goat receives a total of 4,061,867 weekly downloads. As such, escape-goat popularity was classified as popular.
We found that escape-goat demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
GitHub removed 27 malicious pull requests attempting to inject harmful code across multiple open source repositories, in another round of low-effort attacks.
Security News
RubyGems.org has added a new "maintainer" role that allows for publishing new versions of gems. This new permission type is aimed at improving security for gem owners and the service overall.
Security News
Node.js will be enforcing stricter semver-major PR policies a month before major releases to enhance stability and ensure reliable release candidates.