@syncfusion/ej2-base 23.1.36 → 23.1.40

package/dist/es6/ej2-base.es5.js

@@ -9987,13 +9987,54 @@ var SanitizeHtmlHelper = /** @__PURE__ @class */ (function () {
         this.removeAttrs = item.selectors.attributes;
         this.removeTags = item.selectors.tags;
         this.wrapElement = document.createElement('div');
-        this.wrapElement.innerHTML = value;
+        this.wrapElement.innerHTML = this.sanitizeQuotes(value);
         this.removeXssTags();
         this.removeJsEvents();
         this.removeXssAttrs();
         var tempEleValue = this.wrapElement.innerHTML;
         this.removeElement();
-        return tempEleValue.replace('&', '&');
+        return tempEleValue.replace(/&/g, '&');
+    };
+    SanitizeHtmlHelper.sanitizeQuotes = function (input) {
+        var sanityChars = [96, 39, 34];
+        var escape = 92;
+        var sanitizedValue = '';
+        var quoteCounts = {
+            96: 0,
+            39: 0,
+            34: 0
+        };
+        var isPreviousCharBackslash = false;
+        for (var i = 0; i < input.length; i++) {
+            var currentChar = input.charCodeAt(i);
+            if (sanityChars.indexOf(currentChar) !== -1 && !isPreviousCharBackslash) {
+                quoteCounts[currentChar + '']++;
+            }
+            isPreviousCharBackslash = currentChar === escape;
+        }
+        try {
+            // Replace the quotes which has total count is in odd number
+            // Previous char is not backslash, open parenthesis and
+            // Next is not close parenthesis
+            for (var i = 0; i < input.length; i++) {
+                var currentChar = input.charCodeAt(i);
+                var previousChar = i > 0 ? input.charCodeAt(i - 1) : null;
+                var nextChar = i < input.length - 1 ? input.charCodeAt(i + 1) : null;
+                if (sanityChars.indexOf(currentChar) !== -1 && previousChar !== escape) {
+                    if (quoteCounts[currentChar + ''] % 2 === 1 && previousChar !== 40 && nextChar !== 41) {
+                        sanitizedValue += String.fromCharCode(escape);
+                    }
+                    sanitizedValue += input[i + ''];
+                }
+                else {
+                    sanitizedValue += input[i + ''];
+                }
+            }
+            return sanitizedValue;
+        }
+        catch (error) {
+            return input;
+        }
     };
     SanitizeHtmlHelper.removeElement = function () {
         // Removes an element's attibute to avoid html tag validation