_escape

HTML escaping utilities for Rosettes.

Thread-safe string escaping for HTML output.

Design Philosophy:

This module usesstr.translate()with a pre-computed table for maximum performance. This is faster than regex or multiplestr.replace()calls:

• str.translate(): ~0.2µs per call (C-level implementation)
• regex sub(): ~1.5µs per call
• chainedreplace(): ~0.8µs per call

For syntax highlighting,escape_html()is called once per token, so performance here directly impacts overall throughput.

Security:

Escapes the standard five HTML special characters:

• &→&(must be first to avoid double-escaping)
• <→<(prevents tag injection)
• >→>(prevents tag injection)
• "→"(prevents attribute injection)
• '→'(prevents attribute injection in single quotes)

This provides protection against XSS when embedding code in HTML.

Thread-Safety:

The escape table is immutable (dict with int keys). The function uses only the input string and the table — no shared mutable state.

See Also:

• rosettes.formatters.html: Usesescape_htmlfor all token values