mirror of
https://github.com/whoisclebs/lodash.git
synced 2026-01-29 06:27:49 +00:00
Remove escaping backticks.
This commit is contained in:
18
lodash.js
18
lodash.js
@@ -370,8 +370,7 @@
|
||||
'<': '<',
|
||||
'>': '>',
|
||||
'"': '"',
|
||||
"'": ''',
|
||||
'`': '`'
|
||||
"'": '''
|
||||
};
|
||||
|
||||
/** Used to map HTML entities to characters. */
|
||||
@@ -380,8 +379,7 @@
|
||||
'<': '<',
|
||||
'>': '>',
|
||||
'"': '"',
|
||||
''': "'",
|
||||
'`': '`'
|
||||
''': "'"
|
||||
};
|
||||
|
||||
/** Used to escape characters for inclusion in compiled string literals. */
|
||||
@@ -13842,8 +13840,8 @@
|
||||
}
|
||||
|
||||
/**
|
||||
* Converts the characters "&", "<", ">", '"', "'", and "\`" in `string` to
|
||||
* their corresponding HTML entities.
|
||||
* Converts the characters "&", "<", ">", '"', and "'" in `string` to their
|
||||
* corresponding HTML entities.
|
||||
*
|
||||
* **Note:** No other characters are escaped. To escape additional
|
||||
* characters use a third-party library like [_he_](https://mths.be/he).
|
||||
@@ -13854,12 +13852,6 @@
|
||||
* [Mathias Bynens's article](https://mathiasbynens.be/notes/ambiguous-ampersands)
|
||||
* (under "semi-related fun fact") for more details.
|
||||
*
|
||||
* Backticks are escaped because in IE < 9, they can break out of
|
||||
* attribute values or HTML comments. See [#59](https://html5sec.org/#59),
|
||||
* [#102](https://html5sec.org/#102), [#108](https://html5sec.org/#108), and
|
||||
* [#133](https://html5sec.org/#133) of the
|
||||
* [HTML5 Security Cheatsheet](https://html5sec.org/) for more details.
|
||||
*
|
||||
* When working with HTML you should always
|
||||
* [quote attribute values](http://wonko.com/post/html-escaping) to reduce
|
||||
* XSS vectors.
|
||||
@@ -14750,7 +14742,7 @@
|
||||
|
||||
/**
|
||||
* The inverse of `_.escape`; this method converts the HTML entities
|
||||
* `&`, `<`, `>`, `"`, `'`, and ``` in `string` to
|
||||
* `&`, `<`, `>`, `"`, and `'` in `string` to
|
||||
* their corresponding characters.
|
||||
*
|
||||
* **Note:** No other HTML entities are unescaped. To unescape additional
|
||||
|
||||
Reference in New Issue
Block a user