/usr/share/javascript/yui3/escape/escape.js is in libjs-yui3-full 3.5.1-1ubuntu3.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 | /*
YUI 3.5.1 (build 22)
Copyright 2012 Yahoo! Inc. All rights reserved.
Licensed under the BSD License.
http://yuilibrary.com/license/
*/
YUI.add('escape', function(Y) {
/**
Provides utility methods for escaping strings.
@module escape
@class Escape
@static
@since 3.3.0
**/
var HTML_CHARS = {
'&': '&',
'<': '<',
'>': '>',
'"': '"',
"'": ''',
'/': '/',
'`': '`'
},
Escape = {
// -- Public Static Methods ------------------------------------------------
/**
Returns a copy of the specified string with special HTML characters
escaped. The following characters will be converted to their
corresponding character entities:
& < > " ' / `
This implementation is based on the [OWASP HTML escaping
recommendations][1]. In addition to the characters in the OWASP
recommendations, we also escape the <code>`</code> character, since IE
interprets it as an attribute delimiter.
If _string_ is not already a string, it will be coerced to a string.
[1]: http://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet
@method html
@param {String} string String to escape.
@return {String} Escaped string.
@static
**/
html: function (string) {
return (string + '').replace(/[&<>"'\/`]/g, Escape._htmlReplacer);
},
/**
Returns a copy of the specified string with special regular expression
characters escaped, allowing the string to be used safely inside a regex.
The following characters, and all whitespace characters, are escaped:
- $ ^ * ( ) + [ ] { } | \ , . ?
If _string_ is not already a string, it will be coerced to a string.
@method regex
@param {String} string String to escape.
@return {String} Escaped string.
@static
**/
regex: function (string) {
// There's no need to escape !, =, and : since they only have meaning
// when they follow a parenthesized ?, as in (?:...), and we already
// escape parens and question marks.
return (string + '').replace(/[\-$\^*()+\[\]{}|\\,.?\s]/g, '\\$&');
},
// -- Protected Static Methods ---------------------------------------------
/**
* Regex replacer for HTML escaping.
*
* @method _htmlReplacer
* @param {String} match Matched character (must exist in HTML_CHARS).
* @returns {String} HTML entity.
* @static
* @protected
*/
_htmlReplacer: function (match) {
return HTML_CHARS[match];
}
};
Escape.regexp = Escape.regex;
Y.Escape = Escape;
}, '3.5.1' ,{requires:['yui-base']});
|