Escape backslash, closes #516

validatorjs · Sep 27, 2016 · 534a35e · 534a35e
1 parent e33d38a
commit 534a35e
Show file tree

Hide file tree

Showing 6 changed files with 9 additions and 3 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,6 +2,8 @@
 
 - Renamed `isNull()` to `isEmpty()`
   ([#574](https://github.com/chriso/validator.js/issues/574))
+- Backslash is now escaped in `escape()`
+  ([#516](https://github.com/chriso/validator.js/issues/516))
 - Improved `normalizeEmail()`
   ([#583](https://github.com/chriso/validator.js/pull/583))
 

diff --git a/lib/escape.js b/lib/escape.js
@@ -13,6 +13,6 @@ function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { de
 
 function escape(str) {
       (0, _assertString2.default)(str);
-      return str.replace(/&/g, '&amp;').replace(/"/g, '&quot;').replace(/'/g, '&#x27;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/\//g, '&#x2F;').replace(/`/g, '&#96;');
+      return str.replace(/&/g, '&amp;').replace(/"/g, '&quot;').replace(/'/g, '&#x27;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/\//g, '&#x2F;').replace(/\\/g, '&#x5C;').replace(/`/g, '&#96;');
 }
 module.exports = exports['default'];
diff --git a/src/lib/escape.js b/src/lib/escape.js
@@ -8,5 +8,6 @@ export default function escape(str) {
         .replace(/</g, '&lt;')
         .replace(/>/g, '&gt;')
         .replace(/\//g, '&#x2F;')
+        .replace(/\\/g, '&#x5C;')
         .replace(/`/g, '&#96;'));
 }
diff --git a/test/sanitizers.js b/test/sanitizers.js
@@ -139,6 +139,9 @@ describe('Sanitizers', function () {
 
         'Backtick: `':
             'Backtick: &#96;',
+
+        'Backslash: \\':
+            'Backslash: &#x5C;',
       },
     });
   });

diff --git a/validator.js b/validator.js
@@ -1077,7 +1077,7 @@
 
       function escape(str) {
             assertString(str);
-            return str.replace(/&/g, '&amp;').replace(/"/g, '&quot;').replace(/'/g, '&#x27;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/\//g, '&#x2F;').replace(/`/g, '&#96;');
+            return str.replace(/&/g, '&amp;').replace(/"/g, '&quot;').replace(/'/g, '&#x27;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/\//g, '&#x2F;').replace(/\\/g, '&#x5C;').replace(/`/g, '&#96;');
       }
 
       function unescape(str) {

diff --git a/validator.min.js b/validator.min.js