fix(html): escape bad html (#67)

* feat(preset-html5): add feature to filter javascript: urls

* fix(plugin-helper): escape html in attrs

* fix(plugin-helper): tests for html escape

* refactor(preset-html5): remove html escape from preset

* feat(preset): add ability to pass and extend preset options

packages/bbob-plugin-helper/src/index.js

@@ -27,7 +27,14 @@ const appendToNode = (node, value) => {
  * Replaces " to &qquot;
  * @param {String} value
  */
-const escapeQuote = (value) => value.replace(/"/g, '"');
+const escapeHTML = (value) => value
+  .replace(/&/g, '&')
+  .replace(/</g, '&lt;')
+  .replace(/>/g, '&gt;')
+  .replace(/"/g, '&quot;')
+  .replace(/'/g, '&#039;')
+  // eslint-disable-next-line no-script-url
+  .replace('javascript:', 'javascript%3A');
 
 /**
  * Acept name and value and return valid html5 attribute string
@@ -41,8 +48,8 @@ const attrValue = (name, value) => {
   const types = {
     boolean: () => (value ? `${name}` : ''),
     number: () => `${name}="${value}"`,
-    string: () => `${name}="${escapeQuote(value)}"`,
-    object: () => `${name}="${escapeQuote(JSON.stringify(value))}"`,
+    string: () => `${name}="${escapeHTML(value)}"`,
+    object: () => `${name}="${escapeHTML(JSON.stringify(value))}"`,
   };
 
   return types[type] ? types[type]() : '';
@@ -78,6 +85,7 @@ export {
   attrsToString,
   attrValue,
   appendToNode,
+  escapeHTML,
   getNodeLength,
   getUniqAttr,
   isTagNode,

packages/bbob-plugin-helper/test/index.test.js

@@ -80,11 +80,26 @@ describe('@bbob/plugin-helper', () => {
       disabled: true
     })).toBe(` tag="test" foo="bar" disabled`)
   });
-  
+
   test('attrsToString undefined', () => {
     expect(attrsToString(undefined)).toBe('')
   });
 
+  describe('attrsToString escape', () => {
+    test(`javascript:alert("hello")`, () => {
+      expect(attrsToString({
+        onclick: `javascript:alert('hello')`,
+        href: `javascript:alert('hello')`,
+      })).toBe(` onclick="javascript%3Aalert('hello')" href="javascript%3Aalert('hello')"`)
+    });
+    test(`<tag>`, () => {
+      expect(attrsToString({
+        onclick: `<tag>`,
+        href: `<tag>`,
+      })).toBe(` onclick="&lt;tag&gt;" href="&lt;tag&gt;"`)
+    });
+  });
+
   test('getUniqAttr with unq attr', () => {
     expect(getUniqAttr({foo: true, 'http://bar.com': 'http://bar.com'})).toBe('http://bar.com')
   });