From 0e520343a7ed100d9d9ab66884798742ff8732c0 Mon Sep 17 00:00:00 2001
From: Nico Rehwaldt <nico.rehwaldt@camunda.com>
Date: Wed, 12 Jun 2019 13:48:20 +0200
Subject: [PATCH] chore(util): add reusable escape util

---
 lib/features/bendpoints/Bendpoints.js |  6 ++++--
 lib/util/EscapeUtil.js                | 14 ++++++++++++++
 test/spec/util/EscapeUtilSpec.js      | 20 ++++++++++++++++++++
 3 files changed, 38 insertions(+), 2 deletions(-)
 create mode 100644 lib/util/EscapeUtil.js
 create mode 100644 test/spec/util/EscapeUtilSpec.js

diff --git a/lib/features/bendpoints/Bendpoints.js b/lib/features/bendpoints/Bendpoints.js
index 89bb1acc6..96f723f1d 100644
--- a/lib/features/bendpoints/Bendpoints.js
+++ b/lib/features/bendpoints/Bendpoints.js
@@ -14,7 +14,9 @@ import {
   toCanvasCoordinates
 } from './BendpointUtil';
 
-import cssEscape from 'css.escape';
+import {
+  escapeCSS
+} from '../../util/EscapeUtil';
 
 import {
   pointsAligned,
@@ -98,7 +100,7 @@ export default function Bendpoints(
   function getBendpointsContainer(element, create) {
 
     var layer = canvas.getLayer('overlays'),
-        gfx = domQuery('.djs-bendpoints[data-element-id="' + cssEscape(element.id) + '"]', layer);
+        gfx = domQuery('.djs-bendpoints[data-element-id="' + escapeCSS(element.id) + '"]', layer);
 
     if (!gfx && create) {
       gfx = svgCreate('g');
diff --git a/lib/util/EscapeUtil.js b/lib/util/EscapeUtil.js
new file mode 100644
index 000000000..e9dbe81b3
--- /dev/null
+++ b/lib/util/EscapeUtil.js
@@ -0,0 +1,14 @@
+export {
+  default as escapeCSS
+} from 'css.escape';
+
+var HTML_ESCAPE_MAP = {
+  '<': '&lt',
+  '>': '&gt'
+};
+
+export function escapeHTML(str) {
+  return str.replace(/[<>]/g, function(match) {
+    return HTML_ESCAPE_MAP[match];
+  });
+}
\ No newline at end of file
diff --git a/test/spec/util/EscapeUtilSpec.js b/test/spec/util/EscapeUtilSpec.js
new file mode 100644
index 000000000..4f53c23a3
--- /dev/null
+++ b/test/spec/util/EscapeUtilSpec.js
@@ -0,0 +1,20 @@
+import {
+  escapeCSS,
+  escapeHTML
+} from 'lib/util/EscapeUtil';
+
+
+describe('util/EscapeUtil', function() {
+
+  it('escapeCSS', function() {
+    expect(escapeCSS('..ab')).to.eql('\\.\\.ab');
+  });
+
+
+  it('escapeHTML', function() {
+    var htmlStr = '<video src=1 onerror=alert(\'hueh\')>';
+
+    expect(escapeHTML(htmlStr)).to.eql('&ltvideo src=1 onerror=alert(\'hueh\')&gt');
+  });
+
+});
\ No newline at end of file