html_builders.js 3.3 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889
  1. "use strict";
  2. /**
  3. * @license
  4. * SPDX-License-Identifier: Apache-2.0
  5. */
  6. Object.defineProperty(exports, "__esModule", { value: true });
  7. exports.concatHtmls = exports.createScriptSrc = exports.createScript = exports.htmlEscape = void 0;
  8. var html_impl_1 = require("../internals/html_impl");
  9. var resource_url_impl_1 = require("../internals/resource_url_impl");
  10. var script_impl_1 = require("../internals/script_impl");
  11. /**
  12. * Returns HTML-escaped text as a `SafeHtml` object.
  13. *
  14. * Available options:
  15. * - `preserveSpaces` turns every second consecutive space character into its
  16. * HTML entity representation (` `).
  17. * - `preserveNewlines` turns newline characters into breaks (`<br>`).
  18. * - `preserveTabs` wraps tab characters in a span with style=white-space:pre.
  19. */
  20. function htmlEscape(text, options) {
  21. if (options === void 0) { options = {}; }
  22. var htmlEscapedString = htmlEscapeToString(text);
  23. if (options.preserveSpaces) {
  24. // Do this first to ensure we preserve spaces after newlines and tabs.
  25. htmlEscapedString =
  26. htmlEscapedString.replace(/(^|[\r\n\t ]) /g, '$1&#160;');
  27. }
  28. if (options.preserveNewlines) {
  29. htmlEscapedString = htmlEscapedString.replace(/(\r\n|\n|\r)/g, '<br>');
  30. }
  31. if (options.preserveTabs) {
  32. htmlEscapedString = htmlEscapedString.replace(/(\t+)/g, '<span style="white-space:pre">$1</span>');
  33. }
  34. return (0, html_impl_1.createHtml)(htmlEscapedString);
  35. }
  36. exports.htmlEscape = htmlEscape;
  37. /**
  38. * Creates a `SafeHtml` representing a script tag with inline script content.
  39. */
  40. function createScript(script, options) {
  41. if (options === void 0) { options = {}; }
  42. var unwrappedScript = (0, script_impl_1.unwrapScript)(script).toString();
  43. var stringTag = "<script";
  44. if (options.id) {
  45. stringTag += " id=\"".concat(htmlEscapeToString(options.id), "\"");
  46. }
  47. if (options.nonce) {
  48. stringTag += " nonce=\"".concat(htmlEscapeToString(options.nonce), "\"");
  49. }
  50. if (options.type) {
  51. stringTag += " type=\"".concat(htmlEscapeToString(options.type), "\"");
  52. }
  53. stringTag += ">".concat(unwrappedScript, "</script>");
  54. return (0, html_impl_1.createHtml)(stringTag);
  55. }
  56. exports.createScript = createScript;
  57. /**
  58. * Creates a `SafeHtml` representing a script tag with the src attribute.
  59. * This also supports CSP nonces and async loading.
  60. */
  61. function createScriptSrc(src, async, nonce) {
  62. var unwrappedSrc = (0, resource_url_impl_1.unwrapResourceUrl)(src).toString();
  63. var stringTag = "<script src=\"".concat(htmlEscapeToString(unwrappedSrc), "\"");
  64. if (async) {
  65. stringTag += ' async';
  66. }
  67. if (nonce) {
  68. stringTag += " nonce=\"".concat(htmlEscapeToString(nonce), "\"");
  69. }
  70. stringTag += '>\x3c/script>';
  71. return (0, html_impl_1.createHtml)(stringTag);
  72. }
  73. exports.createScriptSrc = createScriptSrc;
  74. /**
  75. * HTML-escapes the given text (`&`, `<`, `>`, `"` and `'`).
  76. */
  77. function htmlEscapeToString(text) {
  78. var escaped = text.replace(/&/g, '&amp;')
  79. .replace(/</g, '&lt;')
  80. .replace(/>/g, '&gt;')
  81. .replace(/"/g, '&quot;')
  82. .replace(/'/g, '&apos;');
  83. return escaped;
  84. }
  85. /** Creates a `SafeHtml` value by concatenating multiple `SafeHtml`s. */
  86. function concatHtmls(htmls) {
  87. return (0, html_impl_1.createHtml)(htmls.map(html_impl_1.unwrapHtml).join(''));
  88. }
  89. exports.concatHtmls = concatHtmls;