new line in key string will cause "Keys must not contain" error

[dannycochran]

The following will result in a Firebase validation error for keys:

let myKey = `function () {
      foo;
  }`;
myKey = fkey.safe(myKey);
myDatabase.set(`somePath/${myKey}`, 'foobar');

The usage of newline doesn't seem documented anywhere by Firebase, however.

Update: It looks like the firebase docs actually do mention that ASCII control characters 0-31 or 127 are prohibited: https://firebase.google.com/docs/database/usage/limits

The regexp in this library should probably be updated to account for those characters.

[esprehn]

This library is escaping things to a custom encoding for example . becomes d<>, but it doesn't escape < or > so characters can become mangled when round tripped (ex. a user entering "<>d" would turn into ".") The library also needs to be updated to handle ascii control chars as discussed above.

A simpler approach is to use URI encoding. encodeURIComponent and decodeURIComponent exist in node and browsers. The only char that's not handled is ".", but since URI encoding can handle any char that can be converted to %2E. Decoding can always be done with decodeURIComponent.

const encode = (value) => encodeURIComponent(value).replace(/\./g, '%2E');
const decode = (value) => decodeURIComponent(value);

That's enough to replace this library without the bug mentioned here or the mangling of user input.