[Summary view] [Print] [Text view]

   1  /**
   2   * @output wp-includes/js/wp-sanitize.js
   3   */
   4  
   5  /**
   6   * Provides helper functions to sanitize strings.
   7   */
   8  ( function () {
   9  
  10      window.wp = window.wp || {};
  11  
  12      /**
  13       * wp.sanitize
  14       *
  15       * Helper functions to sanitize strings.
  16       */
  17      wp.sanitize = {
  18  
  19          /**
  20           * Strip HTML tags.
  21           *
  22           * @param {string} text Text to strip the HTML tags from.
  23           *
  24           * @return {string} Stripped text.
  25           */
  26          stripTags: function( text ) {
  27              if ( 'string' !== typeof text ) {
  28                  return '';
  29              }
  30  
  31              const domParser = new DOMParser();
  32              const htmlDocument = domParser.parseFromString(
  33                  text,
  34                  'text/html'
  35              );
  36  
  37              /*
  38               * The following self-assignment appears to be a no-op, but it isn't.
  39               * It enforces the escaping. Reading the `innerText` property decodes
  40               * character references, returning a raw string. When written, however,
  41               * the text is re-escaped to ensure that the rendered text replicates
  42               * what it's given.
  43               *
  44               * See <https://github.com/WordPress/wordpress-develop/pull/10536#discussion_r2550615378>.
  45               */
  46              htmlDocument.body.innerText = htmlDocument.body.innerText;
  47  
  48              // Return the text with stripped tags.
  49              return htmlDocument.body.innerHTML;
  50          },
  51  
  52          /**
  53           * Strip HTML tags and convert HTML entities.
  54           *
  55           * @param {string} text Text to strip tags and convert HTML entities.
  56           *
  57           * @return {string} Sanitized text.
  58           */
  59          stripTagsAndEncodeText: function( text ) {
  60              let _text = wp.sanitize.stripTags( text ),
  61                  textarea = document.createElement( 'textarea' );
  62  
  63              try {
  64                  textarea.textContent = _text;
  65                  _text = wp.sanitize.stripTags( textarea.value );
  66              } catch ( er ) {}
  67  
  68              return _text;
  69          }
  70      };
  71  }() );