From c3a8bf8d4b8baf7b11b5cdd33a616ce331769a1d Mon Sep 17 00:00:00 2001 From: adon Date: Fri, 13 Mar 2015 16:31:54 +0800 Subject: [PATCH] updated the comment for inUnQuotedAttr --- src/xss-filters.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/xss-filters.js b/src/xss-filters.js index 82ea0e8..04d2afb 100644 --- a/src/xss-filters.js +++ b/src/xss-filters.js @@ -392,7 +392,7 @@ exports.inDoubleQuotedAttr = privFilters.yavd; * @function module:xss-filters#inUnQuotedAttr * * @param {string} s - An untrusted user input -* @returns {string} The string s with any tab, LF, FF, space, and '>' encoded. +* @returns {string} The string s with any tab, LF, FF, space, and '>' encoded. If the first char is either ' " or `, it is also encoded. If an empty string is encountered, return a NULL character '\u0000'. * * @description *

Warning: This is NOT designed for any onX (e.g., onclick) attributes!