From b1b0fcd0547f1b432baab03038903414a1475a1b Mon Sep 17 00:00:00 2001
From: Michael Williamson <mike@zwobble.org>
Date: Sat, 14 Dec 2013 15:06:22 +0000
Subject: Escape attribute values

---
 lib/html-generator.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'lib/html-generator.js')

diff --git a/lib/html-generator.js b/lib/html-generator.js
index 62c58a8..eea0fcf 100644
--- a/lib/html-generator.js
+++ b/lib/html-generator.js
@@ -88,7 +88,7 @@ function HtmlGenerator() {
     
     function generateAttributeString(attributes) {
         return _.map(attributes, function(value, key) {
-            return util.format(' %s="%s"', key, value);
+            return util.format(' %s="%s"', key, escapeHtml(value));
         }).join("");
     }
     
-- 
cgit v1.2.3