From 9de6bed1cd4f24f591c4aa2a3012501bd792c157 Mon Sep 17 00:00:00 2001
From: Michael Williamson <mike@zwobble.org>
Date: Wed, 14 Oct 2015 19:26:10 +0100
Subject: Don't escape double quotes outside of attributes

---
 lib/writers/html-writer.js | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

(limited to 'lib')

diff --git a/lib/writers/html-writer.js b/lib/writers/html-writer.js
index f1761c9..456e894 100644
--- a/lib/writers/html-writer.js
+++ b/lib/writers/html-writer.js
@@ -114,12 +114,12 @@ function simpleWriter() {
     
     function generateAttributeString(attributes) {
         return _.map(attributes, function(value, key) {
-            return util.format(' %s="%s"', key, escapeHtml(value));
+            return util.format(' %s="%s"', key, escapeHtmlAttribute(value));
         }).join("");
     }
     
     function text(value) {
-        fragments.push(escapeHtml(value));
+        fragments.push(escapeHtmlText(value));
     }
     
     function append(html) {
@@ -140,8 +140,14 @@ function simpleWriter() {
     };
 }
 
+function escapeHtmlText(value) {
+    return value
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;');
+}
 
-function escapeHtml(value) {
+function escapeHtmlAttribute(value) {
     return value
         .replace(/&/g, '&amp;')
         .replace(/"/g, '&quot;')
-- 
cgit v1.2.3