.xss() is incorrectly escaping the < to &lt; of the closing tag

[balupton]

I'm getting the following result with version 1.5.1:

node -e "console.log(require('validator').sanitize('<code>&lt;head&gt;</code>').xss())"
<code>&lt;head&gt;&lt;/code>

Where I would expect it to stay the same:

node -e "console.log(require('validator').sanitize('<code>&lt;head&gt;</code>').xss())"
<code>&lt;head&gt;</code>

[mreinstein]

@chriso I'm curious why the removal of xss() ? Is there a recommended alternative module to handle this escaping? It's a great filter to support.

[chriso]

The commit message has more info

The xss() function was originally a port of the XSS filter from
CodeIgniter. I added it to the library because there wasn't an
alternative at the time. Unfortunately I don't have the time or
expertise to maintain the XSS filter or keep merging upstream
changes.

If you need one for your app, I suggest looking at Caja sanitisation
engine maintained by Google. (https://code.google.com/p/google-caja/
source/browse/trunk/src/com/google/caja/plugin/html-sanitizer.js)