Initial project import

tools/v/vlib/encoding/html/escape.v

@@ -0,0 +1,101 @@
+module html
+
+import encoding.hex
+import strconv
+
+@[params]
+pub struct EscapeConfig {
+pub:
+	quote bool = true
+}
+
+@[params]
+pub struct UnescapeConfig {
+	EscapeConfig
+pub:
+	all bool
+}
+
+const escape_seq = ['&', '&amp;', '<', '&lt;', '>', '&gt;']
+const escape_quote_seq = ['"', '&#34;', "'", '&#39;']
+const unescape_seq = ['&amp;', '&', '&lt;', '<', '&gt;', '>']
+const unescape_quote_seq = ['&#34;', '"', '&#39;', "'"]
+
+// escape converts special characters in the input, specifically "<", ">", and "&"
+// to HTML-safe sequences. If `quote` is set to true (which is default), quotes in
+// HTML will also be translated. Both double and single quotes will be affected.
+// **Note:** escape() supports funky accents by doing nothing about them. V's UTF-8
+// support through `string` is robust enough to deal with these cases.
+pub fn escape(input string, config EscapeConfig) string {
+	return if config.quote {
+		input.replace_each(escape_seq).replace_each(escape_quote_seq)
+	} else {
+		input.replace_each(escape_seq)
+	}
+}
+
+// unescape converts entities like "&lt;" to "<". By default it is the converse of `escape`.
+// If `all` is set to true, it handles named, numeric, and hex values - for example,
+// `'&apos;'`, `'&#39;'`, and `'&#x27;'` then unescape to "'".
+pub fn unescape(input string, config UnescapeConfig) string {
+	return if config.all {
+		unescape_all(input)
+	} else if config.quote {
+		input.replace_each(unescape_seq).replace_each(unescape_quote_seq)
+	} else {
+		input.replace_each(unescape_seq)
+	}
+}
+
+fn unescape_all(input string) string {
+	mut result := []rune{}
+	runes := input.runes()
+	mut i := 0
+	for i < runes.len {
+		if runes[i] == `&` {
+			mut j := i + 1
+			for j < runes.len && runes[j] != `;` {
+				j++
+			}
+			if j < runes.len && runes[i + 1] == `#` {
+				// Numeric escape sequences (e.g., &#39; or &#x27;)
+				if runes[i + 2] == `x` || runes[i + 2] == `X` {
+					// Hexadecimal escape sequence
+					if v := hex.decode(runes[i + 3..j].string()) {
+						mut n := u16(0)
+						for x in v {
+							n = n * 256 + x
+						}
+						result << n
+					} else {
+						// Leave invalid sequences unchanged
+						result << runes[i..j + 1]
+						i = j + 1
+					}
+				} else {
+					// Decimal escape sequence
+					if v := strconv.atoi(runes[i + 2..j].string()) {
+						result << v
+					} else {
+						// Leave invalid sequences unchanged
+						result << runes[i..j + 1]
+					}
+				}
+			} else {
+				// Named entity (e.g., &lt;)
+				entity := runes[i + 1..j].string()
+				if v := named_references[entity] {
+					result << v
+				} else {
+					// Leave unknown entities unchanged
+					result << runes[i..j + 1]
+				}
+			}
+			i = j + 1
+		} else {
+			result << runes[i]
+			i++
+		}
+	}
+	return result.string()
+}

tools/v/vlib/encoding/html/escape_test.v

@@ -0,0 +1,71 @@
+import encoding.html
+
+fn test_escape_html() {
+	assert html.escape('<>&') == '&lt;&gt;&amp;'
+	assert html.escape('No change') == 'No change'
+	assert html.escape('<b>Bold text</b>') == '&lt;b&gt;Bold text&lt;/b&gt;'
+	assert html.escape('<img />') == '&lt;img /&gt;'
+	assert html.escape("' onmouseover='alert(1)'") == '&#39; onmouseover=&#39;alert(1)&#39;'
+	assert html.escape("<a href='http://www.example.com'>link</a>") == '&lt;a href=&#39;http://www.example.com&#39;&gt;link&lt;/a&gt;'
+	assert html.escape("<script>alert('hello');</script>") == '&lt;script&gt;alert(&#39;hello&#39;);&lt;/script&gt;'
+	// Cases obtained from:
+	// https://github.com/apache/commons-lang/blob/master/src/test/java/org/apache/commons/lang3/StringEscapeUtilsTest.java
+	assert html.escape('plain text') == 'plain text'
+	assert html.escape('') == ''
+	assert html.escape('bread & butter') == 'bread &amp; butter'
+	assert html.escape('"bread" & butter') == '&#34;bread&#34; &amp; butter'
+	assert html.escape('greater than >') == 'greater than &gt;'
+	assert html.escape('< less than') == '&lt; less than'
+	// Leave accents as-is
+	assert html.escape('café') == 'café'
+	assert html.escape('<p>façade</p>') == '&lt;p&gt;façade&lt;/p&gt;'
+}
+
+fn test_unescape_html() {
+	// Test different formats
+	assert html.unescape('&#39;&#x27;&apos;') == "'&#x27;&apos;"
+	// Converse escape tests
+	assert html.unescape('&lt;&gt;&amp;') == '<>&'
+	assert html.unescape('No change') == 'No change'
+	assert html.unescape('&lt;b&gt;Bold text&lt;/b&gt;') == '<b>Bold text</b>'
+	assert html.unescape('&lt;img /&gt;') == '<img />'
+	assert html.unescape('&#39; onmouseover=&#39;alert(1)&#39;') == "' onmouseover='alert(1)'"
+	assert html.unescape('&lt;a href=&#39;http://www.example.com&#39;&gt;link&lt;/a&gt;') == "<a href='http://www.example.com'>link</a>"
+	assert html.unescape('&lt;script&gt;alert(&#39;hello&#39;);&lt;/script&gt;') == "<script>alert('hello');</script>"
+	// Cases obtained from:
+	// https://github.com/apache/commons-lang/blob/master/src/test/java/org/apache/commons/lang3/StringEscapeUtilsTest.java
+	assert html.unescape('plain text') == 'plain text'
+	assert html.unescape('') == ''
+	assert html.unescape('bread &amp; butter') == 'bread & butter'
+	assert html.unescape('&#34;bread&#34; &amp; butter') == '"bread" & butter'
+	assert html.unescape('greater than &gt;') == 'greater than >'
+	assert html.unescape('&lt; less than') == '< less than'
+	// Leave accents as-is
+	assert html.unescape('café') == 'café'
+	assert html.unescape('&lt;p&gt;façade&lt;/p&gt;') == '<p>façade</p>'
+}
+
+fn test_unescape_all_html() {
+	// Test different formats
+	assert html.unescape('&#39;&#x27;&apos;', all: true) == "'''"
+	assert html.unescape('&#10836; = &#x02a54; = &#X02A54; = &Or;', all: true) == '⩔ = ⩔ = ⩔ = ⩔'
+	// Converse escape tests
+	assert html.unescape('&lt;&gt;&amp;', all: true) == '<>&'
+	assert html.unescape('No change', all: true) == 'No change'
+	assert html.unescape('&lt;b&gt;Bold text&lt;/b&gt;', all: true) == '<b>Bold text</b>'
+	assert html.unescape('&lt;img /&gt;', all: true) == '<img />'
+	assert html.unescape('&#39; onmouseover=&#39;alert(1)&#39;', all: true) == "' onmouseover='alert(1)'"
+	assert html.unescape('&lt;a href=&#39;http://www.example.com&#39;&gt;link&lt;/a&gt;', all: true) == "<a href='http://www.example.com'>link</a>"
+	assert html.unescape('&lt;script&gt;alert(&#39;hello&#39;);&lt;/script&gt;', all: true) == "<script>alert('hello');</script>"
+	// Cases obtained from:
+	// https://github.com/apache/commons-lang/blob/master/src/test/java/org/apache/commons/lang3/StringEscapeUtilsTest.java
+	assert html.unescape('plain text', all: true) == 'plain text'
+	assert html.unescape('', all: true) == ''
+	assert html.unescape('bread &amp; butter', all: true) == 'bread & butter'
+	assert html.unescape('&#34;bread&#34; &amp; butter', all: true) == '"bread" & butter'
+	assert html.unescape('greater than &gt;', all: true) == 'greater than >'
+	assert html.unescape('&lt; less than', all: true) == '< less than'
+	// Leave accents as-is
+	assert html.unescape('café', all: true) == 'café'
+	assert html.unescape('&lt;p&gt;façade&lt;/p&gt;', all: true) == '<p>façade</p>'
+}