LibWeb: Escape "<" and ">" when serializing attribute values

See https://github.com/whatwg/html/pull/6362
This commit is contained in:
Gingeh 2025-05-22 14:53:53 +10:00 committed by Sam Atkins
parent fbc56f74bd
commit f1eaecc630
Notes: github-actions[bot] 2025-05-22 06:56:41 +00:00

View file

@ -4698,14 +4698,15 @@ static String escape_string(StringView string, AttributeMode attribute_mode)
// 2. Replace any occurrences of the U+00A0 NO-BREAK SPACE character by the string "&nbsp;".
else if (code_point == 0xA0)
builder.append("&nbsp;"sv);
// 3. If the algorithm was invoked in the attribute mode, replace any occurrences of the """ character by the string "&quot;".
// 3. Replace any occurrences of the "<" character by the string "&lt;".
else if (code_point == '<')
builder.append("&lt;"sv);
// 4. Replace any occurrences of the ">" character by the string "&gt;".
else if (code_point == '>')
builder.append("&gt;"sv);
// 5. If the algorithm was invoked in the attribute mode, then replace any occurrences of the """ character by the string "&quot;".
else if (code_point == '"' && attribute_mode == AttributeMode::Yes)
builder.append("&quot;"sv);
// 4. If the algorithm was not invoked in the attribute mode, replace any occurrences of the "<" character by the string "&lt;", and any occurrences of the ">" character by the string "&gt;".
else if (code_point == '<' && attribute_mode == AttributeMode::No)
builder.append("&lt;"sv);
else if (code_point == '>' && attribute_mode == AttributeMode::No)
builder.append("&gt;"sv);
else
builder.append_code_point(code_point);
}