Escape attribute values

2 files changed, 8 insertions, 1 deletions

diff --git a/mammoth/html_generation.py b/mammoth/html_generation.py
index 37d191a..52f9f92 100644
--- a/mammoth/html_generation.py
+++ b/mammoth/html_generation.py
@@ -55,6 +55,6 @@ def _generate_attribute_string(attributes):
         return ""
     else:
         return "".join(
-            ' {0}="{1}"'.format(key, value)
+            ' {0}="{1}"'.format(key, _escape_html(value))
             for key, value in attributes.iteritems()
         )
diff --git a/tests/html_generation_tests.py b/tests/html_generation_tests.py
index c637798..9d1dc9a 100644
--- a/tests/html_generation_tests.py
+++ b/tests/html_generation_tests.py
@@ -57,3 +57,10 @@ def self_closing_tag_can_have_attributes():
     generator = HtmlGenerator()
     generator.self_closing("br", {"data-blah": "42"})
     assert_equal('<br data-blah="42" />', generator.html_string())
+
+
+@istest
+def attribute_values_are_escaped():
+    generator = HtmlGenerator()
+    generator.self_closing("br", {"data-blah": "<"})
+    assert_equal('<br data-blah="&lt;" />', generator.html_string())