Merge pull request #35 from declandewet/encoding-fixes

use different escape sequence on client side

package.json

@@ -6,7 +6,6 @@
   "bugs": "https://github.com/declandewet/vue-meta/issues",
   "dependencies": {
     "deepmerge": "^1.2.0",
-    "lodash.escape": "^4.0.1",
     "lodash.isplainobject": "^4.0.6",
     "object-assign": "^4.1.0"
   },

src/shared/getMetaInfo.js

@@ -1,9 +1,24 @@
 import deepmerge from 'deepmerge'
-import escapeHTML from 'lodash.escape'
 import isPlainObject from 'lodash.isplainobject'
 import isArray from './isArray'
 import getComponentOption from './getComponentOption'
 
+const escapeHTML = (str) => typeof window === 'undefined'
+  // server-side escape sequence
+  ? String(str)
+    .replace(/&/g, '&')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#x27;')
+  // client-side escape sequence
+  : String(str)
+    .replace(/&/g, '\u0026')
+    .replace(/</g, '\u003c')
+    .replace(/>/g, '\u003e')
+    .replace(/"/g, '\u0022')
+    .replace(/'/g, '\u0027')
+
 export default function _getMetaInfo (options = {}) {
   const { keyName, tagIDKeyName } = options
   /**

yarn.lock

@@ -3161,10 +3161,6 @@ lodash.create@3.1.1:
     lodash._basecreate "^3.0.0"
     lodash._isiterateecall "^3.0.0"
 
-lodash.escape@^4.0.1:
-  version "4.0.1"
-  resolved "https://registry.yarnpkg.com/lodash.escape/-/lodash.escape-4.0.1.tgz#c9044690c21e04294beaa517712fded1fa88de98"
-
 lodash.indexof@^4.0.5:
   version "4.0.5"
   resolved "https://registry.yarnpkg.com/lodash.indexof/-/lodash.indexof-4.0.5.tgz#53714adc2cddd6ed87638f893aa9b6c24e31ef3c"