@library-pals/isbn 1.3.0 → 1.3.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@library-pals/isbn",
-  "version": "1.3.0",
+  "version": "1.3.2",
   "description": "Find books by ISBN",
   "exports": "./src/index.js",
   "types": "./src/index.d.ts",

package/src/providers/librofm.js

@@ -102,8 +102,8 @@ export function formatDescription(description) {
   description = description.replaceAll("<b>—</b>", "—");
   // Remove bold tags and contents
   description = description.replaceAll(/<b>.*?<\/b>/g, "");
-  // Remove all other html elements
-  description = description.replaceAll(/<.*?>/g, "");
+  // Strip HTML tags
+  description = stripHtmlTags(description);
   // Trim
   description = description.trim();
   // Remove extra spaces
@@ -132,3 +132,27 @@ function extractGenres(text) {
 
   return genres;
 }
+
+/**
+ * Encodes HTML special characters to prevent XSS attacks.
+ * @param {string} string - The string to encode.
+ * @returns {string} - The encoded string.
+ */
+function encodeHTML(string) {
+  return string
+    .replaceAll("&", "&amp;")
+    .replaceAll("<", "&lt;")
+    .replaceAll(">", "&gt;")
+    .replaceAll('" ', "” ")
+    .replaceAll(' "', "“ ")
+    .replaceAll("'", "&#39;");
+}
+
+/**
+ * Removes HTML tags from a string and encodes it to prevent XSS attacks.
+ * @param {string} string - The string from which to remove HTML tags.
+ * @returns {string} - The sanitized string without HTML tags.
+ */
+function stripHtmlTags(string) {
+  return encodeHTML(string.replaceAll(/<\/?[^>]+(>|$)/g, ""));
+}