1045442655

Build Type

github

Committed by GitHub

Commit Message

Merge 6d95548d8 into 91e42575e

Pull Request Pull Request #397: Compare jscodegen

Run Details

4708 of 5056 branches covered (93.12%)

Branch coverage included in aggregate %.

181 of 189 new or added lines in 11 files covered. (95.77%)

1 existing line in 1 file now uncovered.

9376 of 9605 relevant lines covered (97.62%)

5678562.32 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

75.0

/src/jsCodegen/escapeJavaScriptString.ts

/**
 * Sanitize an untrusted string used in generated JavaScript code as a string
 * literal.
 *
 * Always use this function to escape user-provided strings before including
 * them in JavaScript code that will be evaluated. Not doing so can open up
 * security vulnerabilities, such as cross-site scripting. JSON.stringify
 * ensures the untrusted string is a valid JavaScript string, according to [the
 * ECMAScript specification]{@link https://tc39.es/ecma262/#sec-json.stringify}.
 *
 * String.prototype.replace handles support for characters older JavaScript
 * engines [don't support]{@link
 * https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/JSON/stringify#issue_with_plain_json.stringify_for_use_as_javascript},
 * which ensures this function returns a valid string.
 *
 * @param untrustedString - User provided string.
 *
 * @returns An escaped and valid JavaScript string.
 */
function escapeJavaScriptString(untrustedString: string): string {
        return JSON.stringify(untrustedString)
                .replace(/\u2028/g, '\\u2028') // LINE SEPARATOR
                .replace(/\u2029/g, '\\u2029'); // PARAGRAPH SEPARATOR
}

/**
 * Sanitizes strings to stop them from being executable during interpretation
 * by escaping quotes and parentheses.
 * @param untrustedString User provided string to be sanitized.
 * @returns A sanitized version of the user string.
 */
export function sanitizeString(untrustedString: string): string {
        return untrustedString.replace(/\\/g, '\\\\').replace(/'/g, "\\'");
}

export default escapeJavaScriptString;

1	/**
2	* Sanitize an untrusted string used in generated JavaScript code as a string
3	* literal.
4	*
5	* Always use this function to escape user-provided strings before including
6	* them in JavaScript code that will be evaluated. Not doing so can open up
7	* security vulnerabilities, such as cross-site scripting. JSON.stringify
8	* ensures the untrusted string is a valid JavaScript string, according to [the
9	* ECMAScript specification]{@link https://tc39.es/ecma262/#sec-json.stringify}.
10	*
11	* String.prototype.replace handles support for characters older JavaScript
12	* engines [don't support]{@link
13	* https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/JSON/stringify#issue_with_plain_json.stringify_for_use_as_javascript},
14	* which ensures this function returns a valid string.
15	*
16	* @param untrustedString - User provided string.
17	*
18	* @returns An escaped and valid JavaScript string.
19	*/
20	function escapeJavaScriptString(untrustedString: string): string {
21	return JSON.stringify(untrustedString)	3,729✔
22	.replace(/\u2028/g, '\\u2028') // LINE SEPARATOR
23	.replace(/\u2029/g, '\\u2029'); // PARAGRAPH SEPARATOR
24	}
25
26	/**
27	* Sanitizes strings to stop them from being executable during interpretation
28	* by escaping quotes and parentheses.
29	* @param untrustedString User provided string to be sanitized.
30	* @returns A sanitized version of the user string.
31	*/
32	export function sanitizeString(untrustedString: string): string {	18✔
UNCOV 33	return untrustedString.replace(/\\/g, '\\\\').replace(/'/g, "\\'");	×
34	}
35
36	export default escapeJavaScriptString;	18✔

FontoXML / fontoxpath / 1045442655

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous