diff --git a/lodash/lodash-tests.ts b/lodash/lodash-tests.ts index b4b8c38d7..e8ee17b7a 100644 --- a/lodash/lodash-tests.ts +++ b/lodash/lodash-tests.ts @@ -3853,8 +3853,20 @@ module TestEndsWith { } // _.escape -result = _.escape('fred, barney, & pebbles'); -result = _('fred, barney, & pebbles').escape(); +module TestEscape { + { + let result: string; + + result = _.escape('fred, barney, & pebbles'); + result = _('fred, barney, & pebbles').escape(); + } + + { + let result: _.LoDashExplicitWrapper; + + result = _('fred, barney, & pebbles').chain().escape(); + } +} // _.escapeRegExp module TestEscapeRegExp { diff --git a/lodash/lodash.d.ts b/lodash/lodash.d.ts index 748f94e08..74b933ddb 100644 --- a/lodash/lodash.d.ts +++ b/lodash/lodash.d.ts @@ -9247,6 +9247,18 @@ declare module _ { interface LoDashStatic { /** * Converts the characters "&", "<", ">", '"', "'", and "`", in string to their corresponding HTML entities. + * + * Note: No other characters are escaped. To escape additional characters use a third-party library like he. + * + * Though the ">" character is escaped for symmetry, characters like ">" and "/" don’t need escaping in HTML + * and have no special meaning unless they're part of a tag or unquoted attribute value. See Mathias Bynens’s + * article (under "semi-related fun fact") for more details. + * + * Backticks are escaped because in Internet Explorer < 9, they can break out of attribute values or HTML + * comments. See #59, #102, #108, and #133 of the HTML5 Security Cheatsheet for more details. + * + * When working with HTML you should always quote attribute values to reduce XSS vectors. + * * @param string The string to escape. * @return Returns the escaped string. */ @@ -9260,6 +9272,13 @@ declare module _ { escape(): string; } + interface LoDashExplicitWrapper { + /** + * @see _.escape + */ + escape(): LoDashExplicitWrapper; + } + // _.escapeRegExp interface LoDashStatic { /**