j-forms - npm Package Compare versions

Comparing version 0.0.49 to 0.0.50

package.json

 {
   "name": "j-forms",
   "description": "jewish forms creation from fields or from mongoose models",
-  "version": "0.0.49",
+  "version": "0.0.50",
   "author": "Ishai Jaffe <[e-mail]>",
@@ -6,0 +6,0 @@ "dependencies": {

widgets.js

@@ -37,3 +37,3 @@
             var value = Array.isArray(this.attrs[attr]) ? this.attrs[attr].join(' ') : this.attrs[attr];
-            res.write(' ' + attr + '="' + value + '"');
+            res.write(' ' + attr + '="' + escape_html(value) + '"');
         }
@@ -44,2 +44,7 @@ return this;
 
+function escape_html(str)
+{
+    return str.replace(/</g,'&lt').replace(/>/g,'&gt').replace(/"/,'&quot');
+}
+
 var InputWidget = exports.InputWidget = Widget.extend({
@@ -79,3 +84,3 @@ init: function(type,options)
         res.write(' >');
-        res.write(this.value != null ? this.value :  '');
+        res.write(escape_html(this.value != null ? this.value :  ''));
         res.write('</textarea>');
@@ -82,0 +87,0 @@ return this;

Fixed alerts

Major refactor

Supply chain risk

Package has recently undergone a major refactor. It may be unstable or indicate significant internal changes. Use caution when updating to versions that include significant changes.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

2442033

increased by0.01%

Lines of code

12632

increased by0.03%

Number of medium supply chain risk alerts

0

decreased by-100%

No dependency changes