fix(demo): escape strings before dom insertion

LavaMoat · Dec 12, 2023 · e946e3d · e946e3d
1 parent c1f1165
commit e946e3d
Showing 1 changed file with 9 additions and 1 deletion.
diff --git a/demo/tree/tree.js b/demo/tree/tree.js
@@ -27,9 +27,17 @@ export default function tree(src, dst, limit) {
     return tree;
 }
 
+function escape(htmlStr) {
+    return htmlStr.replaceAll(/&/g, "&amp;")
+          .replaceAll(/</g, "&lt;")
+          .replaceAll(/>/g, "&gt;")
+          .replaceAll(/"/g, "&quot;")
+          .replaceAll(/'/g, "&#39;");
+ }
+
 export function showResult (treeString) {
     const display = document.createElement('pre');
-    display.innerHTML = treeString;
+    display.innerHTML = escape(treeString);
     document.body.appendChild(display)
     console.log(treeString);
 }