Replace the implementation of escapeTextContentForBrowser with escape-html

gulpfile.js

@@ -30,7 +30,10 @@ var paths = {
 };
 
 var moduleMap = Object.assign(
-  {'object-assign': 'object-assign'},
+  {
+    'escape-html': 'escape-html',
+    'object-assign': 'object-assign',
+  },
   require('fbjs/module-map'),
   {
     deepDiffer: 'react-native/lib/deepDiffer',

package.json

@@ -35,6 +35,7 @@
     "coveralls": "^2.11.6",
     "del": "^2.0.2",
     "derequire": "^2.0.3",
+    "escape-html": "1.0.3",
     "eslint": "1.10.3",
     "eslint-plugin-react": "4.1.0",
     "eslint-plugin-react-internal": "file:eslint-rules",

packages/react/package.json

@@ -23,6 +23,7 @@
     "node": ">=0.10.0"
   },
   "dependencies": {
+    "escape-html": "1.0.3",
     "fbjs": "^0.8.1",
     "loose-envify": "^1.1.0",
     "object-assign": "^4.1.0"

scripts/jest/preprocessor.js

@@ -32,6 +32,7 @@ var babelOptions = {
         {},
         moduleMap,
         {
+          'escape-html': 'escape-html',
           'object-assign': 'object-assign',
         }
       ),

src/renderers/dom/shared/__tests__/ReactDOMComponent-test.js

@@ -1024,8 +1024,8 @@ describe('ReactDOMComponent', function() {
           }, '\'"<>&')
         )
       ).toBe(
-        '<div title="&#x27;&quot;&lt;&gt;&amp;" style="text-align:&#x27;&quot;&lt;&gt;&amp;;">' +
-          '&#x27;&quot;&lt;&gt;&amp;' +
+        '<div title="&#39;&quot;&lt;&gt;&amp;" style="text-align:&#39;&quot;&lt;&gt;&amp;;">' +
+          '&#39;&quot;&lt;&gt;&amp;' +
         '</div>'
       );
     });

src/renderers/dom/shared/escapeTextContentForBrowser.js

@@ -11,19 +11,7 @@
 
 'use strict';
 
-var ESCAPE_LOOKUP = {
-  '&': '&',
-  '>': '>',
-  '<': '&lt;',
-  '"': '&quot;',
-  '\'': '&#x27;',
-};
-
-var ESCAPE_REGEX = /[&><"']/g;
-
-function escaper(match) {
-  return ESCAPE_LOOKUP[match];
-}
+var escapeHtml = require('escape-html');
 
 /**
  * Escapes text to prevent scripting attacks.
@@ -32,7 +20,16 @@ function escaper(match) {
  * @return {string} An escaped string.
  */
 function escapeTextContentForBrowser(text) {
-  return ('' + text).replace(ESCAPE_REGEX, escaper);
+  switch (typeof text) {
+    case 'boolean':
+    case 'number':
+      // this shortcircuit helps perf for types that we know will never have
+      // special characters, especially given that this function is used often
+      // for numeric dom ids.
+      return '' + text;
+    default:
+      return escapeHtml(text);
+  }
 }
 
 module.exports = escapeTextContentForBrowser;