diff options
| -rw-r--r-- | mammoth/html_generation.py | 2 | ||||
| -rw-r--r-- | tests/html_generation_tests.py | 7 |
2 files changed, 8 insertions, 1 deletions
diff --git a/mammoth/html_generation.py b/mammoth/html_generation.py index 37d191a..52f9f92 100644 --- a/mammoth/html_generation.py +++ b/mammoth/html_generation.py @@ -55,6 +55,6 @@ def _generate_attribute_string(attributes): return "" else: return "".join( - ' {0}="{1}"'.format(key, value) + ' {0}="{1}"'.format(key, _escape_html(value)) for key, value in attributes.iteritems() ) diff --git a/tests/html_generation_tests.py b/tests/html_generation_tests.py index c637798..9d1dc9a 100644 --- a/tests/html_generation_tests.py +++ b/tests/html_generation_tests.py @@ -57,3 +57,10 @@ def self_closing_tag_can_have_attributes(): generator = HtmlGenerator() generator.self_closing("br", {"data-blah": "42"}) assert_equal('<br data-blah="42" />', generator.html_string()) + + +@istest +def attribute_values_are_escaped(): + generator = HtmlGenerator() + generator.self_closing("br", {"data-blah": "<"}) + assert_equal('<br data-blah="<" />', generator.html_string()) |