web-manager 3.2.63 → 3.2.64

package/lib/utilities.js

@@ -108,29 +108,19 @@ Utilities.clipboardCopy = function (input) {
 Utilities.escapeHTML = function (str) {
   shadow = shadow || document.createElement('p');
   shadow.innerHTML = '';
+
+  // This automatically escapes HTML entities like <, >, &, etc.
   shadow.appendChild(document.createTextNode(str));
 
-  return shadow.innerHTML
-    .replaceAll('&', '&amp;')
-    .replaceAll('<', '&lt;')
-    .replaceAll('>', '&gt;')
-    .replaceAll('"', '&quot;')
-    .replaceAll('\'', '&#039;');
-
-  // return shadow.innerHTML.replace(/[&<>"']/g, function (m) {
-  //   switch (m) {
-  //     case '&':
-  //       return '&amp;';
-  //     case '<':
-  //       return '&lt;';
-  //     case '>':
-  //       return '&gt;';
-  //     case '"':
-  //       return '&quot;';
-  //     case "'":
-  //       return '&#039;';
-  //   }
-  // });
+  // This is needed to escape quotes to prevent attribute injection
+  return shadow.innerHTML.replace(/["']/g, function(m) {
+    switch (m) {
+      case '"':
+        return '&quot;';
+      default:
+        return '&#039;';
+    }
+  });
 }
 
 Utilities.getContext = function () {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "web-manager",
-  "version": "3.2.63",
+  "version": "3.2.64",
   "description": "Easily access important variables such as the query string, current domain, and current page in a single object.",
   "main": "index.js",
   "scripts": {