escape-html 1.0.3

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify pkg:npm/escape-html@1.0.3
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:npm/escape-html@1.0.3
Constraints:
  - executionContext: node
Required runtime conditions:
  - ecosystem: npm
  - language: javascript
  - moduleSystem: cjs
  - packageManager: npm@10.9.8
  - runtime: node@22.23.2

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:22f53021d6f0be25c46846deef91b6c96b1bf062cdd6cd6498fc809320575b3a","constraints":{"executionContext":"node"},"contract":["escapeHtml escapes ampersand, double quote, single quote, less-than, and greater-than characters","escapeHtml leaves strings without special HTML characters unchanged","escapeHtml correctly handles strings containing only special characters or repeated characters","escapeHtml converts non-string primitives and objects to strings before escaping","escapeHtml handles empty strings returning an empty string"],"goal":"verify pkg:npm/escape-html@1.0.3","kind":"HOW","packages":["pkg:npm/escape-html@1.0.3"],"schemaVersion":1},"contractCommand":["node","test/contract.cjs"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"npm","executionContext":"node","language":"javascript","libc":"glibc","libcVersion":"2.39","moduleSystem":"cjs","os":"linux","osVersionBucket":"24","packageManager":"npm","packageManagerVersion":"10.9.8","runtime":"node","runtimeVersion":"22.23.2","schemaVersion":1},"license":"MIT-0","packages":["pkg:npm/escape-html@1.0.3"],"schemaVersion":1,"verifierAdapter":"node-typescript@1"}

{
  "name": "escape-html-sample",
  "version": "1.0.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "escape-html-sample",
      "version": "1.0.0",
      "dependencies": {
        "escape-html": "1.0.3"
      }
    },
    "node_modules/escape-html": {
      "version": "1.0.3",
      "resolved": "https://registry.npmjs.org/escape-html/-/escape-html-1.0.3.tgz",
      "integrity": "sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow==",
      "license": "MIT"
    }
  }
}

{
  "name": "escape-html-sample",
  "version": "1.0.0",
  "description": "Minimal sample verifying escape-html",
  "main": "src/index.js",
  "scripts": {
    "test": "node test/contract.cjs"
  },
  "dependencies": {
    "escape-html": "1.0.3"
  }
}

{
  "schemaVersion": 1,
  "goal": "verify pkg:npm/escape-html@1.0.3",
  "kind": "HOW",
  "packages": [
    "pkg:npm/escape-html@1.0.3"
  ],
  "constraints": {
    "executionContext": "node"
  },
  "runtimeConditions": {
    "ecosystem": "npm",
    "language": "javascript",
    "moduleSystem": "cjs",
    "packageManager": "npm@10.9.8",
    "runtime": "node@22.23.2"
  }
}

'use strict';

const escapeHtml = require('escape-html');

/**
 * Escapes special HTML characters in the provided string.
 *
 * @param {any} input - Value to escape.
 * @returns {string} - Escaped HTML string.
 */
function escape(input) {
  return escapeHtml(input);
}

/**
 * Creates an HTML attribute string with an escaped attribute value.
 *
 * @param {string} name - Attribute name.
 * @param {any} value - Attribute value to escape.
 * @returns {string} - Formatted attribute string.
 */
function escapeAttribute(name, value) {
  return `${name}="${escapeHtml(value)}"`;
}

/**
 * Creates an HTML element tag with escaped text content.
 *
 * @param {string} tagName - HTML tag name.
 * @param {any} content - Content to escape.
 * @returns {string} - Formatted HTML tag string.
 */
function escapeTag(tagName, content) {
  return `<${tagName}>${escapeHtml(content)}</${tagName}>`;
}

/**
 * Escapes an array of string values.
 *
 * @param {any[]} items - Array of values to escape.
 * @returns {string[]} - Array of escaped HTML strings.
 */
function escapeMultiple(items) {
  if (!Array.isArray(items)) {
    return [];
  }
  return items.map((item) => escapeHtml(item));
}

module.exports = {
  escape,
  escapeAttribute,
  escapeTag,
  escapeMultiple,
  escapeHtml,
};

const assert = require('node:assert/strict');
const escapeHtml = require('escape-html');
const {
  escape,
  escapeAttribute,
  escapeTag,
  escapeMultiple,
} = require('../src/index.js');

async function main() {
  // Contract 1: escapeHtml escapes ampersand, double quote, single quote, less-than, and greater-than characters
  {
    assert.strictEqual(escapeHtml('&'), '&');
    assert.strictEqual(escapeHtml('"'), '"');
    assert.strictEqual(escapeHtml("'"), ''');
    assert.strictEqual(escapeHtml('<'), '&lt;');
    assert.strictEqual(escapeHtml('>'), '&gt;');
    assert.strictEqual(
      escapeHtml('<script>alert("xss") & \'test\'</script>'),
      '&lt;script&gt;alert(&quot;xss&quot;) &amp; &#39;test&#39;&lt;/script&gt;'
    );
    assert.strictEqual(escape('&'), '&amp;');
    assert.strictEqual(escape('"'), '&quot;');
    assert.strictEqual(escape("'"), '&#39;');
    assert.strictEqual(escape('<'), '&lt;');
    assert.strictEqual(escape('>'), '&gt;');
    assert.strictEqual(
      escapeAttribute('data-title', 'foo & "bar" <baz>'),
      'data-title="foo &amp; &quot;bar&quot; &lt;baz&gt;"'
    );
    assert.strictEqual(
      escapeTag('p', 'Tom & Jerry > "Spike"'),
      '<p>Tom &amp; Jerry &gt; &quot;Spike&quot;</p>'
    );
  }

  // Contract 2: escapeHtml leaves strings without special HTML characters unchanged
  {
    assert.strictEqual(escapeHtml('hello world'), 'hello world');
    assert.strictEqual(escapeHtml('abcxyz 1234567890'), 'abcxyz 1234567890');
    assert.strictEqual(escapeHtml('/path/to/file.ext'), '/path/to/file.ext');
    assert.strictEqual(escape('hello world'), 'hello world');
    assert.deepStrictEqual(
      escapeMultiple(['foo', 'bar', 'baz']),
      ['foo', 'bar', 'baz']
    );
  }

  // Contract 3: escapeHtml correctly handles strings containing only special characters or repeated characters
  {
    assert.strictEqual(escapeHtml('""""'), '&quot;&quot;&quot;&quot;');
    assert.strictEqual(escapeHtml('<<<<'), '&lt;&lt;&lt;&lt;');
    assert.strictEqual(escapeHtml('>>>>'), '&gt;&gt;&gt;&gt;');
    assert.strictEqual(escapeHtml('&&&&'), '&amp;&amp;&amp;&amp;');
    assert.strictEqual(escapeHtml("''''"), '&#39;&#39;&#39;&#39;');
    assert.strictEqual(
      escapeHtml('&<>"\'&<>"\''),
      '&amp;&lt;&gt;&quot;&#39;&amp;&lt;&gt;&quot;&#39;'
    );
    assert.deepStrictEqual(
      escapeMultiple(['<b>bold</b>', 'a & b', '"quote"']),
      ['&lt;b&gt;bold&lt;/b&gt;', 'a &amp; b', '&quot;quote&quot;']
    );
  }

  // Contract 4: escapeHtml converts non-string primitives and objects to strings before escaping
  {
    assert.strictEqual(escapeHtml(12345), '12345');
    assert.strictEqual(escapeHtml(0), '0');
    assert.strictEqual(escapeHtml(true), 'true');
    assert.strictEqual(escapeHtml(false), 'false');
    assert.strictEqual(escapeHtml(null), 'null');
    assert.strictEqual(escapeHtml(undefined), 'undefined');
    assert.strictEqual(
      escapeHtml({
        toString: () => '<custom & object>',
      }),
      '&lt;custom &amp; object&gt;'
    );
  }

  // Contract 5: escapeHtml handles empty strings returning an empty string
  {
    assert.strictEqual(escapeHtml(''), '');
    assert.strictEqual(escape(''), '');
    assert.deepStrictEqual(escapeMultiple([]), []);
    assert.deepStrictEqual(escapeMultiple(null), []);
  }

  console.log('All contracts verified successfully.');
}

main().catch((err) => {
  console.error(err);
  process.exit(1);
});