From 3f2896045e54a254f8ee007c43d179ed750d78b9 Mon Sep 17 00:00:00 2001
From: Michael Williamson <mike@zwobble.org>
Date: Sun, 14 Feb 2016 11:54:18 +0000
Subject: Escape element attribute values

---
 src/main/java/org/zwobble/mammoth/html/HtmlElement.java  |  2 +-
 src/main/java/org/zwobble/mammoth/html/HtmlTextNode.java |  2 +-
 src/main/java/org/zwobble/mammoth/html/HtmlWriter.java   | 11 +++++++++++
 3 files changed, 13 insertions(+), 2 deletions(-)
 create mode 100644 src/main/java/org/zwobble/mammoth/html/HtmlWriter.java

(limited to 'src/main/java/org')

diff --git a/src/main/java/org/zwobble/mammoth/html/HtmlElement.java b/src/main/java/org/zwobble/mammoth/html/HtmlElement.java
index 312cebe..31b1fe2 100644
--- a/src/main/java/org/zwobble/mammoth/html/HtmlElement.java
+++ b/src/main/java/org/zwobble/mammoth/html/HtmlElement.java
@@ -29,7 +29,7 @@ public class HtmlElement implements HtmlNode {
                 .append(" ")
                 .append(attribute.getKey())
                 .append("=\"")
-                .append(attribute.getValue())
+                .append(HtmlWriter.escapeAttributeValue(attribute.getValue()))
                 .append("\"");
         }
 
diff --git a/src/main/java/org/zwobble/mammoth/html/HtmlTextNode.java b/src/main/java/org/zwobble/mammoth/html/HtmlTextNode.java
index c6d02ec..bc8d1f8 100644
--- a/src/main/java/org/zwobble/mammoth/html/HtmlTextNode.java
+++ b/src/main/java/org/zwobble/mammoth/html/HtmlTextNode.java
@@ -9,6 +9,6 @@ public class HtmlTextNode implements HtmlNode {
 
     @Override
     public void write(StringBuilder builder) {
-        builder.append(value.replace("&", "&amp;").replace("<", "&lt;").replace(">", "&gt;"));
+        builder.append(HtmlWriter.escapeText(value));
     }
 }
diff --git a/src/main/java/org/zwobble/mammoth/html/HtmlWriter.java b/src/main/java/org/zwobble/mammoth/html/HtmlWriter.java
new file mode 100644
index 0000000..fdf1e6c
--- /dev/null
+++ b/src/main/java/org/zwobble/mammoth/html/HtmlWriter.java
@@ -0,0 +1,11 @@
+package org.zwobble.mammoth.html;
+
+public class HtmlWriter {
+    public static String escapeText(String text) {
+        return text.replace("&", "&amp;").replace("<", "&lt;").replace(">", "&gt;");
+    }
+
+    public static String escapeAttributeValue(String value) {
+        return escapeText(value).replace("\"", "&quot;");
+    }
+}
-- 
cgit v1.2.3