Escaping & + removing html from desctipion.

src/epub.js

@@ -8,6 +8,25 @@ var xmlSerializer = new XMLSerializer();
 var domParser = new DOMParser();
 var generatedBufferType = 'blob'
 
+/**
+ * I hope JS is single threaded and not preemptive.
+ * Escape XML entities. Ex. & -> &
+ * @param {*} text
+ */
+var escape = function (text){
+    return $('<div>').text(text).html()
+}
+
+var html2txt = function (html) {
+    html = html.replace(/<\/p>/gi, "\n");
+    html = html.replace(/<\/li>/gi, "\n");
+    html = html.replace(/<li>/gi, "-");
+    html = html.replace(/<b>/gi, "*");
+    html = html.replace(/<\/b>/gi, "*");
+    return $('<div>').html(html).text()
+}
+
+
 class EpubXhtml{
     constructor(filename) {
         this.filename = filename
@@ -250,28 +269,28 @@ class EpubMeta{
     }
 
     addBookId(book_id){
-        this.metadata.book_id = book_id
+        this.metadata.book_id = escape(book_id)
     }
     addTitle(title){
-        this.metadata.title = title
+        this.metadata.title = escape(title)
     }
     addAuthor(author){
-        this.metadata.author.push(author)
+        this.metadata.author.push(escape(author))
     }
     addPublisher(publisher){
-        this.metadata.publisher = publisher
+        this.metadata.publisher = escape(publisher)
     }
     addSubject(subject){
-        this.metadata.subject.push(subject)
+        this.metadata.subject.push(escape(subject))
     }
     addLanguage(lang){
-        this.metadata.language = lang
+        this.metadata.language = escape(lang)
     }
     addDescription(description){
-        this.metadata.description = description
+        this.metadata.description = escape(html2txt(description))
     }
     addIsbn(isbn){
-        this.metadata.isbn = isbn
+        this.metadata.isbn = escape(isbn)
     }
 
     addMetaData(){