Decode HTML entities in one pass

mediumDOM & Utilities+250 XPPractice

Content from a CMS or an RSS feed arrives entity-encoded, and you have to decode it before you can search it, count its characters, or send it somewhere that is not HTML. Doing it with repeated replaces creates a real security bug: decode & first and then scan again, and the input &lt; turns into <, which the author explicitly escaped.

Implement unescapeHtml(input). It decodes, in a single left-to-right pass over the string, any entity matching &name;, { or .

The named entities you must support are exactly & to &, < to <, > to >, " to ", ' to ' and   to a normal space. Numeric entities are decimal (') or hexadecimal with a lower or upper case x (/), and decode with String.fromCodePoint of that value. Any entity you do not recognise — ½, &copyright; — is left in the output exactly as written.

Because it is one pass, text produced by decoding is never rescanned: "&lt;" decodes to "<" and stops there. If input is null or undefined, return the empty string "".

Arguments

inputstring | null | undefined: The entity-encoded text to decode. null and undefined both resolve to "".

Returns

string — The decoded text. Unrecognised entities are left exactly as written and decoded output is never rescanned.

Examples

unescapeHtml("&lt;p&gt;Hi &amp; bye&lt;/p&gt;");
// => "<p>Hi & bye</p>"

The common named entities decode in place.

unescapeHtml("&amp;lt;");
// => "&lt;"

A single pass means the decoded < is not re-decoded.

unescapeHtml("&#39;a&#x2F;b&#39;");
// => "'a/b'"

Decimal and hexadecimal numeric entities both decode via String.fromCodePoint.

What it has to do

Decode &, <, >, ", ' and  , with   becoming a normal space.
Decode decimal &#NN; and hexadecimal &#xNN; entities, case-insensitively on the x.
Leave unrecognised entities untouched.
Decode in a single pass, so &lt; becomes < and not <.
Return "" for null and undefined.

Notes

A single global .replace() with a callback is what makes it one pass — the regex never looks at text the callback produced, so decoding &lt; cannot cascade into <.
A real browser decodes hundreds of named entities (©, —, …). This smaller list is enough for round-tripping anything your own escape helper produced.

Stuck? The javascript course covers everything this challenge needs.

Try it yourself· Edit the code, then press Run

Loading playground...

5 tests · +250 XP

Discussion

No comments yet. Be the first to say something.

All challenges133 / 150