From 9de6bed1cd4f24f591c4aa2a3012501bd792c157 Mon Sep 17 00:00:00 2001
From: Michael Williamson <mike@zwobble.org>
Date: Wed, 14 Oct 2015 19:26:10 +0100
Subject: Don't escape double quotes outside of attributes

---
 NEWS                       |  2 ++
 lib/writers/html-writer.js | 12 +++++++++---
 tests/html/write.tests.js  | 12 ++++++++++++
 3 files changed, 23 insertions(+), 3 deletions(-)

diff --git a/NEWS b/NEWS
index bd5e2cf..9027366 100644
--- a/NEWS
+++ b/NEWS
@@ -5,6 +5,8 @@
 
 * Collapse similar non-fresh HTML elements together.
 
+* Don't escape double quotes outside of attributes.
+
 # 0.3.25
 
 * When the styleMap option is passed as a string, ignore lines beginning with #.
diff --git a/lib/writers/html-writer.js b/lib/writers/html-writer.js
index f1761c9..456e894 100644
--- a/lib/writers/html-writer.js
+++ b/lib/writers/html-writer.js
@@ -114,12 +114,12 @@ function simpleWriter() {
     
     function generateAttributeString(attributes) {
         return _.map(attributes, function(value, key) {
-            return util.format(' %s="%s"', key, escapeHtml(value));
+            return util.format(' %s="%s"', key, escapeHtmlAttribute(value));
         }).join("");
     }
     
     function text(value) {
-        fragments.push(escapeHtml(value));
+        fragments.push(escapeHtmlText(value));
     }
     
     function append(html) {
@@ -140,8 +140,14 @@ function simpleWriter() {
     };
 }
 
+function escapeHtmlText(value) {
+    return value
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;');
+}
 
-function escapeHtml(value) {
+function escapeHtmlAttribute(value) {
     return value
         .replace(/&/g, '&amp;')
         .replace(/"/g, '&quot;')
diff --git a/tests/html/write.tests.js b/tests/html/write.tests.js
index 34eaf15..e4a5813 100644
--- a/tests/html/write.tests.js
+++ b/tests/html/write.tests.js
@@ -12,12 +12,24 @@ describe("HTML write", function() {
             "&lt;&gt;&amp;");
     });
     
+    test("double quotes outside of attributes are not escaped", function() {
+        assert.equal(
+            generateString(html.text('"')),
+            '"');
+    });
+    
     test("element attributes are HTML escaped", function() {
         assert.equal(
             generateString(html.freshElement("p", {"x": "<"})),
             '<p x="&lt;"></p>');
     });
     
+    test("double quotes inside attributes are escaped", function() {
+        assert.equal(
+            generateString(html.freshElement("p", {"x": '"'})),
+            '<p x="&quot;"></p>');
+    });
+    
     test("element children are written", function() {
         assert.equal(
             generateString(html.freshElement("p", {}, [html.text("Hello")])),
-- 
cgit v1.2.3