html: stricter escapeAttributeValue

1 files changed, 13 insertions, 3 deletions

diff --git a/src/html.js b/src/html.js
index 30b4d287..eb783ac6 100644
--- a/src/html.js
+++ b/src/html.js
@@ -1420,10 +1420,20 @@ export class Attributes {
   }
 
   #escapeAttributeValue(value) {
-    return value
+    // https://html.spec.whatwg.org/multipage/parsing.html#escapingString
+
+    // assumes the containing attribute value token is written
+    // with double quotes
+
+    value = value
       .toString()
-      .replaceAll('"', '"')
-      .replaceAll("'", ''');
+      .replaceAll('&', '&')
+      .replaceAll('\u00a0', ' ')
+      .replaceAll('<', '&lt;')
+      .replaceAll('>', '&gt;')
+      .replaceAll('"', '&quot;');
+
+    return value;
   }
 
   static parse(string) {