Escape element attribute values

4 files changed, 27 insertions, 2 deletions

diff --git a/src/main/java/org/zwobble/mammoth/html/HtmlElement.java b/src/main/java/org/zwobble/mammoth/html/HtmlElement.java
index 312cebe..31b1fe2 100644
--- a/src/main/java/org/zwobble/mammoth/html/HtmlElement.java
+++ b/src/main/java/org/zwobble/mammoth/html/HtmlElement.java
@@ -29,7 +29,7 @@ public class HtmlElement implements HtmlNode {
                 .append(" ")
                 .append(attribute.getKey())
                 .append("=\"")
-                .append(attribute.getValue())
+                .append(HtmlWriter.escapeAttributeValue(attribute.getValue()))
                 .append("\"");
         }
 
diff --git a/src/main/java/org/zwobble/mammoth/html/HtmlTextNode.java b/src/main/java/org/zwobble/mammoth/html/HtmlTextNode.java
index c6d02ec..bc8d1f8 100644
--- a/src/main/java/org/zwobble/mammoth/html/HtmlTextNode.java
+++ b/src/main/java/org/zwobble/mammoth/html/HtmlTextNode.java
@@ -9,6 +9,6 @@ public class HtmlTextNode implements HtmlNode {
 
     @Override
     public void write(StringBuilder builder) {
-        builder.append(value.replace("&", "&amp;").replace("<", "&lt;").replace(">", "&gt;"));
+        builder.append(HtmlWriter.escapeText(value));
     }
 }
diff --git a/src/main/java/org/zwobble/mammoth/html/HtmlWriter.java b/src/main/java/org/zwobble/mammoth/html/HtmlWriter.java
new file mode 100644
index 0000000..fdf1e6c
--- /dev/null
+++ b/src/main/java/org/zwobble/mammoth/html/HtmlWriter.java
@@ -0,0 +1,11 @@
+package org.zwobble.mammoth.html;
+
+public class HtmlWriter {
+    public static String escapeText(String text) {
+        return text.replace("&", "&amp;").replace("<", "&lt;").replace(">", "&gt;");
+    }
+
+    public static String escapeAttributeValue(String value) {
+        return escapeText(value).replace("\"", "&quot;");
+    }
+}
diff --git a/src/test/java/org/zwobble/mammoth/tests/html/HtmlWriteTests.java b/src/test/java/org/zwobble/mammoth/tests/html/HtmlWriteTests.java
index 71a5b67..9e90e8b 100644
--- a/src/test/java/org/zwobble/mammoth/tests/html/HtmlWriteTests.java
+++ b/src/test/java/org/zwobble/mammoth/tests/html/HtmlWriteTests.java
@@ -24,6 +24,13 @@ public class HtmlWriteTests {
     }
 
     @Test
+    public void doubleQuotesInTextNodesArentHtmlEscaped() {
+        assertEquals(
+            "&gt;&lt;&amp;\"",
+            write(Html.text("><&\"")));
+    }
+
+    @Test
     public void canWriteSelfClosingElement() {
         assertEquals(
             "<br />",
@@ -53,6 +60,13 @@ public class HtmlWriteTests {
             write(Html.element("a", map("class", "external", "href", "http://example.com"))));
     }
 
+    @Test
+    public void attributeValuesAreEscaped() {
+        assertEquals(
+            "<a href=\"&gt;&lt;&amp;&quot;\"></a>",
+            write(Html.element("a", map("href", "><&\""))));
+    }
+
     private String write(HtmlNode node) {
         return Html.write(list(node));
     }