(allura) branch master updated: better escape_html that does quotes too

[brondsem]

This is an automated email from the ASF dual-hosted git repository.

asf-gitbox-commits pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/allura.git


The following commit(s) were added to refs/heads/master by this push:
     new e95355a02 better escape_html that does quotes too
e95355a02 is described below

commit e95355a029c8cde751a7bb41c4e6743906474cb5
Author: Dave Brondsema <d...@brondsema.net>
AuthorDate: Wed Jun 17 12:03:20 2026 -0400

    better escape_html that does quotes too
---
 Allura/allura/public/nf/js/allura-base.js | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/Allura/allura/public/nf/js/allura-base.js 
b/Allura/allura/public/nf/js/allura-base.js
index 4cdfdb081..15ea04f43 100644
--- a/Allura/allura/public/nf/js/allura-base.js
+++ b/Allura/allura/public/nf/js/allura-base.js
@@ -196,7 +196,12 @@ function get_cm($elem) {
 }
 
 function escape_html(str) {
-    return $('<i></i>').text(str).html();
+    return String(str)
+        .replace(/&/g, '&amp;')   // must be first
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
 }
 
 $(function(){