mathiasbynens/he

`�` leaks NULL character

RReverser opened this issue · 2 comments

As per spec, number should be parsed before mapping against the table, so � should be decoded just in the same way as � / � / ..., that is, replaced with \uFFFD.

Currently it instead returns actual "unsafe" \u0000 string.

Good catch! Closing in favor of #44.

@mathiasbynens Well, it's just the issue for the PR. It would be auto-closed when PR is merged ;)