move html escape into a util

src/kibana/apps/discover/directives/table.js

@@ -3,6 +3,7 @@ define(function (require) {
   var html = require('text!apps/discover/partials/table.html');
   var detailsHtml = require('text!apps/discover/partials/row_details.html');
   var moment = require('moment');
+  var htmlEscape = require('utils/html_escape');
 
   var _ = require('lodash');
   var $ = require('jquery');
@@ -284,12 +285,7 @@ define(function (require) {
 
 
           if (breakWords) {
-            text = text.replace(/&/g, '&')
-              .replace(/</g, '&lt;')
-              .replace(/>/g, '&gt;')
-              .replace(/'/g, '&#39;')
-              .replace(/"/g, '&quot;');
-
+            text = htmlEscape(text);
             var lineSize = 0;
             var newText = '';
             for (var i = 0, len = text.length; i < len; i++) {

src/kibana/utils/html_escape.js

@@ -0,0 +1,17 @@
+define(function (require) {
+  var _ = require('lodash');
+  var map = {
+    '&': '&',
+    '<': '&lt;',
+    '>': '&gt;',
+    '\'': '&#39;',
+    '"': '&quot;',
+  };
+
+  var regex = new RegExp('[' + _.keys(map).join('') + ']', 'g');
+  return function htmlEscape(text) {
+    return text.replace(regex, function (c) {
+      return map[c];
+    });
+  };
+});

test/unit/index.html

@@ -102,6 +102,7 @@
           'specs/utils/versionmath',
           'specs/utils/routes/index',
           'specs/utils/sequencer',
+          'specs/utils/html_escape',
           'specs/courier/search_source/_get_normalized_sort',
           'specs/factories/base_object',
           'specs/state_management/state',

test/unit/specs/utils/html_escape.js

@@ -0,0 +1,19 @@
+define(function (require) {
+  describe('HTML Escape Util', function () {
+    var htmlEscape = require('utils/html_escape');
+
+    it('removes tags by replacing their angle-brackets', function () {
+      expect(htmlEscape('<h1>header</h1>')).to.eql('&lt;h1&gt;header&lt;/h1&gt;');
+    });
+
+    it('removes attributes from tags using &quot; and &#39;', function () {
+      expect(htmlEscape('<h1 onclick="alert(\'hi\');">header</h1>'))
+      .to.eql('&lt;h1 onclick=&quot;alert(&#39;hi&#39;);&quot;&gt;header&lt;/h1&gt;');
+    });
+
+    it('escapes existing html entities by escaping their leading &', function () {
+      expect(htmlEscape('&lt;h1&gt;header&lt;/h1&gt;'))
+      .to.eql('&amp;lt;h1&amp;gt;header&amp;lt;/h1&amp;gt;');
+    });
+  });
+});