Incomplete string escaping or encoding

[flyingzebra]

Following function insufficiently sanitises the input. Directly using the string replace method to perform escaping is notoriously error-prone and therefore hackable.

showdown.helper.unescapeHTMLEntities = function (txt) {
  'use strict';

  return txt
    .replace(/"/g, '"')
    .replace(/&lt;/g, '<')
    .replace(/&gt;/g, '>')
    .replace(/&amp;/g, '&');
};

DOMPurify looks over engineered, but it does the job of sanitising. Example code: var clean = DOMPurify.sanitize(dirty);