StatsHouse UI: escape HTML boost (#689)

VKCOM · Aug 16, 2023 · 9f1ee96 · 9f1ee96
1 parent 75b66bc
commit 9f1ee96
Showing 1 changed file with 9 additions and 3 deletions.
diff --git a/statshouse-ui/src/common/helpers.ts b/statshouse-ui/src/common/helpers.ts
@@ -143,7 +143,13 @@ export function mergeLeft<T>(targetMerge: T, valueMerge: T): T {
 }
 
 export function escapeHTML(str: string): string {
-  const d = window.document.createElement('DIV');
-  d.textContent = str;
-  return d.innerHTML;
+  const htmlEscapes: Record<string, string> = {
+    '&': '&amp;',
+    '<': '&lt;',
+    '>': '&gt;',
+    '"': '&quot;',
+    "'": '&#39;',
+  };
+  const reUnescapedHtml = /[&<>"']/g;
+  return str.replace(reUnescapedHtml, (chr) => htmlEscapes[chr]);
 }