string: Escape all HTML’s metacharacters.

[nit.git] / lib / standard / string.nit

diff --git a/lib/standard/string.nit b/lib/standard/string.nit
index e17d2cf..604386f 100644 (file)
--- a/lib/standard/string.nit
+++ b/lib/standard/string.nit
@@ -385,6 +385,19 @@ abstract class Text
        #     assert "\na\nb\tc\t".trim          == "a\nb\tc"
        fun trim: SELFTYPE do return (self.l_trim).r_trim
 
+       # Returns `self` removed from its last `\n` (if any).
+       #
+       #    assert "Hello\n".chomp == "Hello"
+       #    assert "Hello".chomp   == "Hello"
+       #    assert "\n\n\n".chomp  == "\n\n"
+       #
+       # This method is mainly used to remove the LINE_FEED character from lines of text.
+       fun chomp: SELFTYPE
+       do
+               if self.chars.last != '\n' then return self
+               return substring(0, length-1)
+       end
+
        # Justify a self in a space of `length`
        #
        # `left` is the space ratio on the left side.
@@ -640,9 +653,11 @@ abstract class Text
                return buf.to_s
        end
 
-       # Escape the four characters `<`, `>`, `&`, and `"` with their html counterpart
+       # Escape the characters `<`, `>`, `&`, `"`, `'` and `/` as HTML/XML entity references.
+       #
+       #     assert "a&b-<>\"x\"/'".html_escape      ==  "a&amp;b-&lt;&gt;&#34;x&#34;&#47;&#39;"
        #
-       #     assert "a&b->\"x\"".html_escape      ==  "a&amp;b-&gt;&quot;x&quot;"
+       # SEE: <https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet#RULE_.231_-_HTML_Escape_Before_Inserting_Untrusted_Data_into_HTML_Element_Content>
        fun html_escape: SELFTYPE
        do
                var buf = new FlatBuffer
@@ -656,7 +671,11 @@ abstract class Text
                        else if c == '>' then
                                buf.append "&gt;"
                        else if c == '"' then
-                               buf.append "&quot;"
+                               buf.append "&#34;"
+                       else if c == '\'' then
+                               buf.append "&#39;"
+                       else if c == '/' then
+                               buf.append "&#47;"
                        else buf.add c
                end