Remove escaping backticks.

This commit is contained in:
John-David Dalton
2016-08-13 13:22:06 -07:00
parent 7c971587dc
commit 5cca51e978
2 changed files with 13 additions and 21 deletions

View File

@@ -370,8 +370,7 @@
'<': '&lt;',
'>': '&gt;',
'"': '&quot;',
"'": '&#39;',
'`': '&#96;'
"'": '&#39;'
};
/** Used to map HTML entities to characters. */
@@ -380,8 +379,7 @@
'&lt;': '<',
'&gt;': '>',
'&quot;': '"',
'&#39;': "'",
'&#96;': '`'
'&#39;': "'"
};
/** Used to escape characters for inclusion in compiled string literals. */
@@ -13842,8 +13840,8 @@
}
/**
* Converts the characters "&", "<", ">", '"', "'", and "\`" in `string` to
* their corresponding HTML entities.
* Converts the characters "&", "<", ">", '"', and "'" in `string` to their
* corresponding HTML entities.
*
* **Note:** No other characters are escaped. To escape additional
* characters use a third-party library like [_he_](https://mths.be/he).
@@ -13854,12 +13852,6 @@
* [Mathias Bynens's article](https://mathiasbynens.be/notes/ambiguous-ampersands)
* (under "semi-related fun fact") for more details.
*
* Backticks are escaped because in IE < 9, they can break out of
* attribute values or HTML comments. See [#59](https://html5sec.org/#59),
* [#102](https://html5sec.org/#102), [#108](https://html5sec.org/#108), and
* [#133](https://html5sec.org/#133) of the
* [HTML5 Security Cheatsheet](https://html5sec.org/) for more details.
*
* When working with HTML you should always
* [quote attribute values](http://wonko.com/post/html-escaping) to reduce
* XSS vectors.
@@ -14750,7 +14742,7 @@
/**
* The inverse of `_.escape`; this method converts the HTML entities
* `&amp;`, `&lt;`, `&gt;`, `&quot;`, `&#39;`, and `&#96;` in `string` to
* `&amp;`, `&lt;`, `&gt;`, `&quot;`, and `&#39;` in `string` to
* their corresponding characters.
*
* **Note:** No other HTML entities are unescaped. To unescape additional