formist - npm Package Compare versions

Comparing version 0.2.0 to 0.3.0

lib/escape.js

@@ -12,3 +12,3 @@
 
-	return String(value || '').replace(/["'&]/g, function (char) {
+	return String(value || '').replace(/["'&<>]/g, function (char) {
 		return toEscape[char];
@@ -15,0 +15,0 @@ });

lib/tag.js

 
 var escape = require('./escape'),
-	voidElements = ['area','base','br','col','embed','hr','img','input','keygen','link','meta','param','source','track','wbr'];
+	voidElements = ['area','base','br','col','embed','hr','img','input','keygen','link','meta','param','source','track','wbr'],
+	textOnlyElements = ['option', 'rp', 'textarea', 'title'];
 
@@ -49,6 +50,12 @@ var Tag = module.exports = function Tag (name, attributes, content) {
 
-	return (this.content)
+	var content = (this.content)
 		? this.content
 		: '';
 
+	if (textOnlyElements.includes(this.name)) {
+		content = escape(content);
+	}
+
+	return content;
+
 };
@@ -55,0 +62,0 @@

package.json

 {
   "name": "formist",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "A library to publish, consume and validate HTML5 forms.",
@@ -36,2 +36,2 @@ "main": "index.js",
   }
-}
+}

test/test.js

@@ -105,2 +105,9 @@
 
+		it('should escape content tags', function () {
+
+			var tag = new Tag("option", {}, '" /><script>alert(\'xss\')</script><option name="');
+			expect(tag.render()).to.equal('<option>&quot; /&gt;&lt;script&gt;alert(&#39;xss&#39;)&lt;/script&gt;&lt;option name=&quot;</option>');
+
+		});
+
 	});
@@ -107,0 +114,0 @@

No alert changes

Improved metrics

Total package byte prevSize

70004

9.17%

Number of package files

35

2.94%

Lines of code

1468

1.17%

No dependency changes