Escape attribute values

2 files changed, 7 insertions, 1 deletions

diff --git a/lib/html-generator.js b/lib/html-generator.js
index 62c58a8..eea0fcf 100644
--- a/lib/html-generator.js
+++ b/lib/html-generator.js
@@ -88,7 +88,7 @@ function HtmlGenerator() {
     
     function generateAttributeString(attributes) {
         return _.map(attributes, function(value, key) {
-            return util.format(' %s="%s"', key, value);
+            return util.format(' %s="%s"', key, escapeHtml(value));
         }).join("");
     }
     
diff --git a/tests/html-generator.tests.js b/tests/html-generator.tests.js
index fc34cf9..220a0bf 100644
--- a/tests/html-generator.tests.js
+++ b/tests/html-generator.tests.js
@@ -63,4 +63,10 @@ describe('HtmlGenerator', function() {
         generator.closeAll();
         return assert.equal(generator.asString(), '<p class="tip">Hello!</p>');
     });
+    
+    test('attribute values are escaped', function() {
+        var generator = new HtmlGenerator();
+        generator.selfClosing({tagName: "br", attributes: {"data-blah": "<"}});
+        return assert.equal(generator.asString(), '<br data-blah="&lt;" />');
+    });
 })