Method escapeHtml

src/core/Utils.mjs:850–864

* Escapes HTML tags in a string to stop them being rendered. * https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet * * Null bytes are a special case and are converted to a character from the Unicode * Private Use Area, which CyberChef will display as

(str)

     * Utils.escapeHtml("A <script> tag");
     */
    static escapeHtml(str) {
        const HTML_CHARS = {
            "&": "&amp;",
            "<": "&lt;",
            ">": "&gt;",
            '"': "&quot;",
            "'": "&#x27;", // &apos; not recommended because it's not in the HTML spec
            "`": "&#x60;",
            "\u0000": "\ue000"
        };

        return str ? str.replace(/[&<>"'`\u0000]/g, function (match) {
            return HTML_CHARS[match];
        }) : str;
    }


    /**