lib/generate-rss.js

@@ -1,14 +1,13 @@
-import siteMetadata from '@/data/siteMetadata'
+import { escape } from '@/lib/utils/htmlEscaper'
 
-const convertStringToHTML = (string) =>
+import siteMetadata from '@/data/siteMetadata'
-  string.replace(/&/g, '&amp;').replace(/>/g, '&gt;').replace(/</g, '&lt;').replace(/"/g, '&quot;')
 
 const generateRssItem = (post) => `
   <item>
     <guid>${siteMetadata.siteUrl}/blog/${post.slug}</guid>
-    <title>${convertStringToHTML(post.title)}</title>
+    <title>${escape(post.title)}</title>
     <link>${siteMetadata.siteUrl}/blog/${post.slug}</link>
-    <description>${convertStringToHTML(post.summary)}</description>
+    <description>${escape(post.summary)}</description>
     <pubDate>${new Date(post.date).toUTCString()}</pubDate>
     <author>${siteMetadata.email} (${siteMetadata.author})</author>
     ${post.tags.map((t) => `<category>${t}</category>`).join('')}
@@ -18,9 +17,9 @@ const generateRssItem = (post) => `
 const generateRss = (posts, page = 'index.xml') => `
   <rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
     <channel>
-      <title>${convertStringToHTML(siteMetadata.title)}</title>
+      <title>${escape(siteMetadata.title)}</title>
       <link>${siteMetadata.siteUrl}/blog</link>
-      <description>${convertStringToHTML(siteMetadata.description)}</description>
+      <description>${escape(siteMetadata.description)}</description>
       <language>${siteMetadata.language}</language>
       <managingEditor>${siteMetadata.email} (${siteMetadata.author})</managingEditor>
       <webMaster>${siteMetadata.email} (${siteMetadata.author})</webMaster>

lib/utils/htmlEscaper.js

@@ -0,0 +1,23 @@
+const { replace } = ''
+
+// escape
+const es = /&(?:amp|#38|lt|#60|gt|#62|apos|#39|quot|#34);/g
+const ca = /[&<>'"]/g
+
+const esca = {
+  '&': '&amp;',
+  '<': '&lt;',
+  '>': '&gt;',
+  "'": '&#39;',
+  '"': '&quot;',
+}
+const pe = (m) => esca[m]
+
+/**
+ * Safely escape HTML entities such as `&`, `<`, `>`, `"`, and `'`.
+ * @param {string} es the input to safely escape
+ * @returns {string} the escaped input, and it **throws** an error if
+ *  the input type is unexpected, except for boolean and numbers,
+ *  converted as string.
+ */
+export const escape = (es) => replace.call(es, ca, pe)