`html.mjs`

18 lines and 2 functions in DrDustinEdwards/site-runtime, at commit 89e9d58 on 2026-10-24. This file on GitHub.

Functions

The functions of html.mjs
Function	Lines	Complexity	Covered	CRAP	Mutation
escapeHtml	18 to 20	1	100%	OkCRAP 1	No data: mutation testing has not run on this repo yet
<anonymous:19>	19 to 19	2	100%	OkCRAP 2	No data: mutation testing has not run on this repo yet

Imports

It imports no other module of this repo. Imported by mcp-login.mjs.

Source

1/**
2 * HTML escaping, once, for every repo: local copies tended to miss the single quote.
3 *
4 * The five characters that can end a text run or an attribute value: & < > " and '. The result is safe as element
5 * content and as a single- or double-quoted attribute value. It is not safe in an unquoted attribute, in a URL
6 * attribute that may hold `javascript:`, or inside <script> or <style>: those need their own encoding.
7 */
8
9/** @type {Readonly<Record<string, string>>} */
10const ESCAPES = { "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" };
11
12/**
13 * `value` as HTML text: & < > " ' replaced by their entities, every other character unchanged. A value that is not a
14 * string is first made one with String(), as a template literal would.
15 * @param {unknown} value
16 * @returns {string}
17 */
18export function escapeHtml(value) {
19  return String(value).replace(/[&<>"']/g, (ch) => ESCAPES[ch] ?? ch);
20}