all repos — htmlformat @ 5bd994fe268e4d505a9793143fa85414c7d50887

Go package and CLI tool used to format HTML

fix: escape attribute values

Adrian Hesketh
commit

5bd994fe268e4d505a9793143fa85414c7d50887

parent

c3d4a33d8ada426554c3f42f92cf139c4a742fdd

2 files changed, 38 insertions(+), 4 deletions(-)

changed files
M format.go → format.go
@@ -59,7 +59,7 @@ if _, err = fmt.Fprintf(w, "<%s", n.Data); err != nil {
 			return
 		}
 		for _, a := range n.Attr {
-			val := a.Val
+			val := html.EscapeString(a.Val)
 			if _, err = fmt.Fprintf(w, ` %s="%s"`, a.Key, val); err != nil {
 				return
 			}

@@ -130,7 +130,8 @@ if _, err = fmt.Fprintf(w, "<%s", n.Data); err != nil {
 			return
 		}
 		for _, a := range n.Attr {
-			if _, err = fmt.Fprintf(w, ` %s="%s"`, a.Key, a.Val); err != nil {
+			val := html.EscapeString(a.Val)
+			if _, err = fmt.Fprintf(w, ` %s="%s"`, a.Key, val); err != nil {
 				return
 			}
 		}
M format_test.go → format_test.go
@@ -14,10 +14,43 @@ input    string
 		expected string
 	}{
 		{
-			name:  "html elements are indented",
+			name:  "missing closing tags are inserted",
+			input: `<li>`,
+			expected: `<li>
+</li>
+`,
+		},
+		{
+			name:  "html attribute escaping is normalized",
+			input: `<ol> <li style="&amp;&#38;"> A </li> <li> B </li> </ol> `,
+			expected: `<ol>
+ <li style="&amp;&amp;">
+  A
+ </li>
+ <li>
+  B
+ </li>
+</ol>
+`,
+		},
+		{
+			name:  "bare ampersands are escaped",
 			input: `<ol> <li style="&"> A </li> <li> B </li> </ol> `,
 			expected: `<ol>
- <li style="&">
+ <li style="&amp;">
+  A
+ </li>
+ <li>
+  B
+ </li>
+</ol>
+`,
+		},
+		{
+			name:  "html elements are indented",
+			input: `<ol> <li class="name"> A </li> <li> B </li> </ol> `,
+			expected: `<ol>
+ <li class="name">
   A
  </li>
  <li>