HTML: fix attribute quoting bugs

tdewolff · May 22, 2022 · 893ef0d · 893ef0d
1 parent 184bfb2
commit 893ef0d
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 6 deletions.
diff --git a/html/util.go b/html/util.go
@@ -22,7 +22,10 @@ func EscapeAttrVal(buf *[]byte, b []byte, origQuote byte, mustQuote, isXML bool)
 	}
 	if unquoted && (!mustQuote || origQuote == 0) && !isXML {
 		return b
-	} else if singles == 0 && origQuote == '\'' || doubles == 0 && origQuote == '"' {
+	} else if singles == 0 && origQuote == '\'' && !isXML || doubles == 0 && origQuote == '"' {
+		if len(b)+2 > cap(*buf) {
+			*buf = make([]byte, 0, len(b)+2)
+		}
 		t := (*buf)[:len(b)+2]
 		t[0] = origQuote
 		copy(t[1:], b)
@@ -37,7 +40,7 @@ func EscapeAttrVal(buf *[]byte, b []byte, origQuote byte, mustQuote, isXML bool)
 		n += doubles * 4
 		quote = '"'
 		escapedQuote = doubleQuoteEntityBytes
-		if singles == doubles && origQuote == '\'' {
+		if singles == doubles && origQuote == '\'' && !isXML {
 			quote = '\''
 			escapedQuote = singleQuoteEntityBytes
 		}

diff --git a/html/util_test.go b/html/util_test.go
@@ -29,11 +29,14 @@ func TestEscapeAttrVal(t *testing.T) {
 	for _, tt := range escapeAttrValTests {
 		t.Run(tt.attrVal, func(t *testing.T) {
 			b := []byte(tt.attrVal)
-			orig := b
+			var quote byte
+			if 0 < len(b) && (b[0] == '\'' || b[0] == '"') {
+				quote = b[0]
+			}
 			if len(b) > 1 && (b[0] == '"' || b[0] == '\'') && b[0] == b[len(b)-1] {
 				b = b[1 : len(b)-1]
 			}
-			val := EscapeAttrVal(&buf, orig, b, false)
+			val := EscapeAttrVal(&buf, b, quote, false, false)
 			test.String(t, string(val), tt.expected)
 		})
 	}
@@ -44,18 +47,23 @@ func TestEscapeAttrValXML(t *testing.T) {
 		attrVal  string
 		expected string
 	}{
+		{`"xyz"`, `"xyz"`},
 		{`xyz`, `"xyz"`},
+		{`'xyz'`, `"xyz"`},
 		{``, `""`},
 	}
 	var buf []byte
 	for _, tt := range escapeAttrValTests {
 		t.Run(tt.attrVal, func(t *testing.T) {
 			b := []byte(tt.attrVal)
-			orig := b
+			var quote byte
+			if 0 < len(b) && (b[0] == '\'' || b[0] == '"') {
+				quote = b[0]
+			}
 			if len(b) > 1 && (b[0] == '"' || b[0] == '\'') && b[0] == b[len(b)-1] {
 				b = b[1 : len(b)-1]
 			}
-			val := EscapeAttrVal(&buf, orig, b, true)
+			val := EscapeAttrVal(&buf, b, quote, false, true)
 			test.String(t, string(val), tt.expected)
 		})
 	}