[Summary view] [Print] [Text view]

   1  /**
   2   * @output wp-includes/js/wp-sanitize.js
   3   */
   4  
   5  ( function () {
   6  
   7      window.wp = window.wp || {};
   8  
   9      /**
  10       * wp.sanitize
  11       *
  12       * Helper functions to sanitize strings.
  13       */
  14      wp.sanitize = {
  15  
  16          /**
  17           * Strip HTML tags.
  18           *
  19           * @param {string} text - Text to strip the HTML tags from.
  20           *
  21           * @return {string} Stripped text.
  22           */
  23          stripTags: function( text ) {
  24              if ( 'string' !== typeof text ) {
  25                  return '';
  26              }
  27  
  28              const domParser = new DOMParser();
  29              const htmlDocument = domParser.parseFromString(
  30                  text,
  31                  'text/html'
  32              );
  33  
  34              /*
  35               * The following self-assignment appears to be a no-op, but it isn't.
  36               * It enforces the escaping. Reading the `innerText` property decodes
  37               * character references, returning a raw string. When written, however,
  38               * the text is re-escaped to ensure that the rendered text replicates
  39               * what it's given.
  40               *
  41               * See <https://github.com/WordPress/wordpress-develop/pull/10536#discussion_r2550615378>.
  42               */
  43              htmlDocument.body.innerText = htmlDocument.body.innerText;
  44  
  45              // Return the text with stripped tags.
  46              return htmlDocument.body.innerHTML;
  47          },
  48  
  49          /**
  50           * Strip HTML tags and convert HTML entities.
  51           *
  52           * @param {string} text - Text to strip tags and convert HTML entities.
  53           *
  54           * @return {string} Sanitized text.
  55           */
  56          stripTagsAndEncodeText: function( text ) {
  57              let _text = wp.sanitize.stripTags( text ),
  58                  textarea = document.createElement( 'textarea' );
  59  
  60              try {
  61                  textarea.textContent = _text;
  62                  _text = wp.sanitize.stripTags( textarea.value );
  63              } catch ( er ) {}
  64  
  65              return _text;
  66          }
  67      };
  68  }() );