fix: not escaping double quotes in attribute values

miyagi-dev · Jun 26, 2024 · 88725a8 · 88725a8
1 parent 9281185
commit 88725a8
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 1 deletion.
diff --git a/drupal-attribute.js b/drupal-attribute.js
@@ -104,8 +104,11 @@ DrupalAttribute.prototype.toString = function () {
       ? value.join(" ")
       : typeof value === "boolean" ? String(value) : value;
 
+    // HTML-escape `"` characters.
+    const escapedValue = normalizedValue.replace(/"/g, '&quot;');
+
     // Set `attribute` instead of `attribute=""` when the value is the empty string.
-    components.push(attribute + (normalizedValue === "" ? "" : '="' + normalizedValue + '"'));
+    components.push(attribute + (escapedValue === "" ? "" : '="' + escapedValue + '"'));
   });
 
   let rendered = components.join(" ");

diff --git a/drupal-attribute.test.js b/drupal-attribute.test.js
@@ -23,6 +23,12 @@ describe("DrupalAttribute", () => {
       },
       ` class="one two three"`,
     ],
+    [
+      {
+        test: '"double-quotes"',
+      },
+      ' test="&quot;double-quotes&quot;"'
+    ],
   ])("toString", (attributes, htmlAttributeString) => {
     const drupalAttribute = new DrupalAttribute(Object.entries(attributes))
     expect(drupalAttribute.toString()).toEqual(htmlAttributeString);