@syncfusion/ej2-base 23.1.36 → 23.1.40

package/dist/es6/ej2-base.es2015.js

@@ -9860,13 +9860,54 @@ class SanitizeHtmlHelper {
         this.removeAttrs = item.selectors.attributes;
         this.removeTags = item.selectors.tags;
         this.wrapElement = document.createElement('div');
-        this.wrapElement.innerHTML = value;
+        this.wrapElement.innerHTML = this.sanitizeQuotes(value);
         this.removeXssTags();
         this.removeJsEvents();
         this.removeXssAttrs();
         const tempEleValue = this.wrapElement.innerHTML;
         this.removeElement();
-        return tempEleValue.replace('&', '&');
+        return tempEleValue.replace(/&/g, '&');
+    }
+    static sanitizeQuotes(input) {
+        const sanityChars = [96, 39, 34];
+        const escape = 92;
+        let sanitizedValue = '';
+        const quoteCounts = {
+            96: 0,
+            39: 0,
+            34: 0
+        };
+        let isPreviousCharBackslash = false;
+        for (let i = 0; i < input.length; i++) {
+            const currentChar = input.charCodeAt(i);
+            if (sanityChars.indexOf(currentChar) !== -1 && !isPreviousCharBackslash) {
+                quoteCounts[currentChar + '']++;
+            }
+            isPreviousCharBackslash = currentChar === escape;
+        }
+        try {
+            // Replace the quotes which has total count is in odd number
+            // Previous char is not backslash, open parenthesis and
+            // Next is not close parenthesis
+            for (let i = 0; i < input.length; i++) {
+                const currentChar = input.charCodeAt(i);
+                const previousChar = i > 0 ? input.charCodeAt(i - 1) : null;
+                const nextChar = i < input.length - 1 ? input.charCodeAt(i + 1) : null;
+                if (sanityChars.indexOf(currentChar) !== -1 && previousChar !== escape) {
+                    if (quoteCounts[currentChar + ''] % 2 === 1 && previousChar !== 40 && nextChar !== 41) {
+                        sanitizedValue += String.fromCharCode(escape);
+                    }
+                    sanitizedValue += input[i + ''];
+                }
+                else {
+                    sanitizedValue += input[i + ''];
+                }
+            }
+            return sanitizedValue;
+        }
+        catch (error) {
+            return input;
+        }
     }
     static removeElement() {
         // Removes an element's attibute to avoid html tag validation