fix

book/node_modules/escape-goat/index.d.ts

@@ -0,0 +1,62 @@
+/**
+Escape a string for use in HTML.
+
+Escapes the following characters in the given `string` argument: `&` `<` `>` `"` `'`.
+
+@example
+```
+import {htmlEscape} from 'escape-goat';
+
+htmlEscape('🦄 & 🐐');
+//=> '🦄 &amp; 🐐'
+
+htmlEscape('Hello <em>World</em>');
+//=> 'Hello &lt;em&gt;World&lt;/em&gt;'
+```
+*/
+export function htmlEscape(string: string): string;
+
+/**
+Unescape an HTML string to use as a plain string.
+
+Unescapes the following HTML entities in the given `htmlString` argument: `&amp;` `&lt;` `&gt;` `&quot;` `&#39;`.
+
+@example
+```
+import {htmlUnescape} from 'escape-goat';
+
+htmlUnescape('🦄 &amp; 🐐');
+//=> '🦄 & 🐐'
+```
+*/
+export function htmlUnescape(htmlString: string): string;
+
+/**
+[Tagged template literal](https://developer.mozilla.org/en/docs/Web/JavaScript/Reference/Template_literals#Tagged_template_literals) that escapes interpolated values.
+
+@example
+```
+import {htmlEscape} from 'escape-goat';
+
+const url = 'https://sindresorhus.com?x="🦄"';
+
+htmlEscape`<a href="${url}">Unicorn</a>`;
+//=> '<a href="https://sindresorhus.com?x=&quot;🦄&quot;">Unicorn</a>'
+```
+*/
+export function htmlEscape(template: TemplateStringsArray, ...substitutions: readonly unknown[]): string;
+
+/**
+[Tagged template literal](https://developer.mozilla.org/en/docs/Web/JavaScript/Reference/Template_literals#Tagged_template_literals) that unescapes interpolated values.
+
+@example
+```
+import {htmlUnescape} from 'escape-goat';
+
+const escapedUrl = 'https://sindresorhus.com?x=&quot;🦄&quot;';
+
+htmlUnescape`URL from HTML: ${url}`;
+//=> 'URL from HTML: https://sindresorhus.com?x="🦄"'
+```
+*/
+export function htmlUnescape(template: TemplateStringsArray, ...substitutions: readonly unknown[]): string;

book/node_modules/escape-goat/index.js

@@ -0,0 +1,41 @@
+'use strict';
+
+const htmlEscape = string => string
+	.replace(/&/g, '&')
+	.replace(/"/g, '"')
+	.replace(/'/g, ''')
+	.replace(/</g, '&lt;')
+	.replace(/>/g, '&gt;');
+
+const htmlUnescape = htmlString => htmlString
+	.replace(/&gt;/g, '>')
+	.replace(/&lt;/g, '<')
+	.replace(/&#0?39;/g, '\'')
+	.replace(/&quot;/g, '"')
+	.replace(/&amp;/g, '&');
+
+exports.htmlEscape = (strings, ...values) => {
+	if (typeof strings === 'string') {
+		return htmlEscape(strings);
+	}
+
+	let output = strings[0];
+	for (const [index, value] of values.entries()) {
+		output = output + htmlEscape(String(value)) + strings[index + 1];
+	}
+
+	return output;
+};
+
+exports.htmlUnescape = (strings, ...values) => {
+	if (typeof strings === 'string') {
+		return htmlUnescape(strings);
+	}
+
+	let output = strings[0];
+	for (const [index, value] of values.entries()) {
+		output = output + htmlUnescape(String(value)) + strings[index + 1];
+	}
+
+	return output;
+};

book/node_modules/escape-goat/license

@@ -0,0 +1,9 @@
+MIT License
+
+Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (sindresorhus.com)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

book/node_modules/escape-goat/package.json

@@ -0,0 +1,46 @@
+{
+	"name": "escape-goat",
+	"version": "3.0.0",
+	"description": "Escape a string for use in HTML or the inverse",
+	"license": "MIT",
+	"repository": "sindresorhus/escape-goat",
+	"funding": "https://github.com/sponsors/sindresorhus",
+	"author": {
+		"name": "Sindre Sorhus",
+		"email": "sindresorhus@gmail.com",
+		"url": "sindresorhus.com"
+	},
+	"engines": {
+		"node": ">=10"
+	},
+	"scripts": {
+		"test": "xo && ava && tsd"
+	},
+	"files": [
+		"index.js",
+		"index.d.ts"
+	],
+	"keywords": [
+		"escape",
+		"unescape",
+		"html",
+		"entity",
+		"entities",
+		"escaping",
+		"sanitize",
+		"sanitization",
+		"utility",
+		"template",
+		"attribute",
+		"value",
+		"interpolate",
+		"xss",
+		"goat",
+		"🐐"
+	],
+	"devDependencies": {
+		"ava": "^2.4.0",
+		"tsd": "^0.11.0",
+		"xo": "^0.25.3"
+	}
+}

book/node_modules/escape-goat/readme.md

@@ -0,0 +1,62 @@
+<h1>
+	<img src="logo.jpg" width="1280" alt="escape-goat">
+</h1>
+
+> Escape a string for use in HTML or the inverse
+
+[![Build Status](https://travis-ci.org/sindresorhus/escape-goat.svg?branch=master)](https://travis-ci.org/sindresorhus/escape-goat)
+
+## Install
+
+```
+$ npm install escape-goat
+```
+
+## Usage
+
+```js
+const {htmlEscape, htmlUnescape} = require('escape-goat');
+
+htmlEscape('🦄 & 🐐');
+//=> '🦄 &amp; 🐐'
+
+htmlUnescape('🦄 &amp; 🐐');
+//=> '🦄 & 🐐'
+
+htmlEscape('Hello <em>World</em>');
+//=> 'Hello &lt;em&gt;World&lt;/em&gt;'
+
+const url = 'https://sindresorhus.com?x="🦄"';
+
+htmlEscape`<a href="${url}">Unicorn</a>`;
+//=> '<a href="https://sindresorhus.com?x=&quot;🦄&quot;">Unicorn</a>'
+
+const escapedUrl = 'https://sindresorhus.com?x=&quot;🦄&quot;';
+
+htmlUnescape`URL from HTML: ${url}`;
+//=> 'URL from HTML: https://sindresorhus.com?x="🦄"'
+```
+
+## API
+
+### htmlEscape(string)
+
+Escapes the following characters in the given `string` argument: `&` `<` `>` `"` `'`
+
+The function also works as a [tagged template literal](https://developer.mozilla.org/en/docs/Web/JavaScript/Reference/Template_literals#Tagged_template_literals) that escapes interpolated values.
+
+### htmlUnescape(htmlString)
+
+Unescapes the following HTML entities in the given `htmlString` argument: `&amp;` `&lt;` `&gt;` `&quot;` `&#39;`
+
+The function also works as a [tagged template literal](https://developer.mozilla.org/en/docs/Web/JavaScript/Reference/Template_literals#Tagged_template_literals) that unescapes interpolated values.
+
+## Tip
+
+Ensure you always quote your HTML attributes to prevent possible [XSS](https://en.wikipedia.org/wiki/Cross-site_scripting).
+
+## FAQ
+
+### Why yet another HTML escaping package?
+
+I couldn't find one I liked that was tiny, well-tested, and had both `.escape()` and `.unescape()`.