Fixed bug where intermediate string contains escaped characters

validatorjs · Oct 29, 2021 · 1155582 · 1155582
1 parent 13651ea
commit 1155582
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 3 deletions.
diff --git a/src/lib/unescape.js b/src/lib/unescape.js
@@ -2,12 +2,12 @@ import assertString from './util/assertString';
 
 export default function unescape(str) {
   assertString(str);
-  return (str.replace(/&amp;/g, '&')
-    .replace(/&quot;/g, '"')
+  return (str.replace(/&quot;/g, '"')
     .replace(/&#x27;/g, "'")
     .replace(/&lt;/g, '<')
     .replace(/&gt;/g, '>')
     .replace(/&#x2F;/g, '/')
     .replace(/&#x5C;/g, '\\')
-    .replace(/&#96;/g, '`'));
+    .replace(/&#96;/g, '`')
+    .replace(/&amp;/g, '&'));
 }
diff --git a/test/sanitizers.js b/test/sanitizers.js
@@ -184,6 +184,9 @@ describe('Sanitizers', () => {
 
         'Backtick: &#96;':
             'Backtick: `',
+
+        'Escaped string: &amp;lt;':
+            'Escaped string: &lt;',
       },
     });
   });