source dump of claude code
at main 16 lines 622 B view raw
1/** 2 * Escape XML/HTML special characters for safe interpolation into element 3 * text content (between tags). Use when untrusted strings (process stdout, 4 * user input, external data) go inside `<tag>${here}</tag>`. 5 */ 6export function escapeXml(s: string): string { 7 return s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;') 8} 9 10/** 11 * Escape for interpolation into a double- or single-quoted attribute value: 12 * `<tag attr="${here}">`. Escapes quotes in addition to `& < >`. 13 */ 14export function escapeXmlAttr(s: string): string { 15 return escapeXml(s).replace(/"/g, '&quot;').replace(/'/g, '&apos;') 16}