ghtml 2.0.3 → 2.0.4

package/.eslintrc.json

@@ -3,6 +3,7 @@
   "extends": ["plugin:grules/all"],
   "rules": {
     "no-await-in-loop": "off",
+    "prefer-template": "off",
     "require-unicode-regexp": "off"
   }
 }

package/package.json

@@ -3,7 +3,7 @@
   "description": "Replace your template engine with fast JavaScript by leveraging the power of tagged templates.",
   "author": "Gürgün Dayıoğlu",
   "license": "MIT",
-  "version": "2.0.3",
+  "version": "2.0.4",
   "type": "module",
   "main": "./src/index.js",
   "exports": {

package/src/html.js

@@ -1,20 +1,8 @@
 const arrayIsArray = Array.isArray;
-
 const symbolIterator = Symbol.iterator;
-
 const symbolAsyncIterator = Symbol.asyncIterator;
 
-const escapeDictionary = {
-  '"': """,
-  "&": "&",
-  "'": "'",
-  "<": "&#60;",
-  ">": "&#62;",
-  "`": "&#96;",
-};
-
-const escapeRegExp = new RegExp(`[${Object.keys(escapeDictionary).join("")}]`);
-
+const escapeRegExp = /["&'<>`]/;
 const escapeFunction = (string) => {
   const stringLength = string.length;
   let start = 0;
@@ -22,15 +10,37 @@ const escapeFunction = (string) => {
   let escaped = "";
 
   do {
-    const escapedCharacter = escapeDictionary[string[end++]];
-
-    if (escapedCharacter) {
-      escaped += string.slice(start, end - 1) + escapedCharacter;
-      start = end;
+    switch (string.charCodeAt(end++)) {
+      case 34: // "
+        escaped += string.slice(start, end - 1) + "&#34;";
+        start = end;
+        continue;
+      case 38: // &
+        escaped += string.slice(start, end - 1) + "&#38;";
+        start = end;
+        continue;
+      case 39: // '
+        escaped += string.slice(start, end - 1) + "&#39;";
+        start = end;
+        continue;
+      case 60: // <
+        escaped += string.slice(start, end - 1) + "&#60;";
+        start = end;
+        continue;
+      case 62: // >
+        escaped += string.slice(start, end - 1) + "&#62;";
+        start = end;
+        continue;
+      case 96: // `
+        escaped += string.slice(start, end - 1) + "&#96;";
+        start = end;
+        continue;
     }
   } while (end !== stringLength);
 
-  return escaped + string.slice(start, end);
+  escaped += string.slice(start, end);
+
+  return escaped;
 };
 
 /**
@@ -64,7 +74,9 @@ const html = ({ raw: literals }, ...expressions) => {
     accumulator += literal + string;
   }
 
-  return accumulator + literals[index];
+  accumulator += literals[index];
+
+  return accumulator;
 };
 
 /**

package/test/index.js

@@ -63,6 +63,13 @@ test("renders unsafe content", () => {
   );
 });
 
+test("renders unsafe content /2", () => {
+  assert.strictEqual(
+    html`<p>${`${descriptionUnsafe}"&\``}</p>`,
+    `<p>&#60;script&#62;alert(&#39;This is an unsafe description.&#39;)&#60;/script&#62;&#34;&#38;&#96;</p>`,
+  );
+});
+
 test("renders arrays", () => {
   assert.strictEqual(
     html`<p>${[descriptionSafe, descriptionUnsafe]}</p>`,