search

mathiasbynens / he

A robust HTML entity encoder/decoder written in JavaScript.
https://mths.be/he
MIT License
3.45k stars 254 forks source link

`�` leaks NULL character #43

Closed RReverser closed 8 years ago

RReverser commented 8 years ago

As per spec, number should be parsed before mapping against the table, so � should be decoded just in the same way as � / � / ..., that is, replaced with \uFFFD.

Currently it instead returns actual "unsafe" \u0000 string.

mathiasbynens commented 8 years ago

Good catch! Closing in favor of #44.

RReverser commented 8 years ago

@mathiasbynens Well, it's just the issue for the PR. It would be auto-closed when PR is merged ;)