haml 3.1.0.alpha.17 → 3.1.0.alpha.18

data/EDGE_GEM_VERSION

@@ -1 +1 @@
-3.1.0.alpha.17
+3.1.0.alpha.18

data/VERSION

@@ -1 +1 @@
-3.1.0.alpha.17
+3.1.0.alpha.18

data/lib/haml/buffer.rb

@@ -209,7 +209,8 @@ RUBY
                       end) ? "" : "\n")
       end
 
-      attributes = Precompiler.build_attributes(html?, @options[:attr_wrapper], attributes)
+      attributes = Precompiler.build_attributes(
+        html?, @options[:attr_wrapper], @options[:escape_attrs], attributes)
       @buffer << "#{nuke_outer_whitespace || @options[:ugly] ? '' : tabs(tabulation)}<#{name}#{attributes}#{str}"
 
       if content

data/lib/haml/engine.rb

@@ -84,6 +84,7 @@ module Haml
         :ugly => false,
         :format => :xhtml,
         :escape_html => false,
+        :escape_attrs => true,
       }
 
 
@@ -294,6 +295,7 @@ module Haml
         :format => @options[:format],
         :encoding => @options[:encoding],
         :escape_html => @options[:escape_html],
+        :escape_attrs => @options[:escape_attrs],
       }
     end
 

data/lib/haml/helpers.rb

@@ -447,6 +447,7 @@ MESSAGE
 
       attributes = Haml::Precompiler.build_attributes(haml_buffer.html?,
                                                       haml_buffer.options[:attr_wrapper],
+                                                      haml_buffer.options[:escape_attrs],
                                                       attrs)
 
       if text.nil? && block.nil? && (haml_buffer.options[:autoclose].include?(name) || flags.include?(:/))

data/lib/haml/precompiler.rb

@@ -523,7 +523,7 @@ END
     end
 
     # This is a class method so it can be accessed from Buffer.
-    def self.build_attributes(is_html, attr_wrapper, attributes = {})
+    def self.build_attributes(is_html, attr_wrapper, escape_attrs, attributes = {})
       quote_escape = attr_wrapper == '"' ? """ : "'"
       other_quote_char = attr_wrapper == '"' ? "'" : '"'
 
@@ -546,16 +546,28 @@ END
           next
         end
 
-        value = Haml::Helpers.preserve(Haml::Helpers.escape_once(value.to_s))
-        # We want to decide whether or not to escape quotes
-        value.gsub!('"', '"')
-        this_attr_wrapper = attr_wrapper
-        if value.include? attr_wrapper
-          if value.include? other_quote_char
-            value = value.gsub(attr_wrapper, quote_escape)
+        escaped =
+          if escape_attrs == :once
+            Haml::Helpers.escape_once(value.to_s)
+          elsif escape_attrs
+            CGI.escapeHTML(value.to_s)
           else
-            this_attr_wrapper = other_quote_char
+            value.to_s
           end
+        value = Haml::Helpers.preserve(escaped)
+        if escape_attrs
+          # We want to decide whether or not to escape quotes
+          value.gsub!('"', '"')
+          this_attr_wrapper = attr_wrapper
+          if value.include? attr_wrapper
+            if value.include? other_quote_char
+              value = value.gsub(attr_wrapper, quote_escape)
+            else
+              this_attr_wrapper = other_quote_char
+            end
+          end
+        else
+          this_attr_wrapper = attr_wrapper
         end
         " #{attr}=#{this_attr_wrapper}#{value}#{this_attr_wrapper}"
       end
@@ -570,7 +582,8 @@ END
     end
 
     def prerender_tag(name, self_close, attributes)
-      attributes_string = Precompiler.build_attributes(html?, @options[:attr_wrapper], attributes)
+      attributes_string = Precompiler.build_attributes(
+        html?, @options[:attr_wrapper], @options[:escape_attrs], attributes)
       "<#{name}#{attributes_string}#{self_close && xhtml? ? ' /' : ''}>"
     end
 

data/test/haml/engine_test.rb

@@ -563,6 +563,28 @@ HTML
 HAML
   end
 
+  def test_escape_attrs_false
+    assert_equal(<<HTML, render(<<HAML, :escape_attrs => false))
+<div class='<?php echo "&quot;" ?>' id='foo'>
+  bar
+</div>
+HTML
+#foo{:class => '<?php echo "&quot;" ?>'}
+  bar
+HAML
+  end
+
+  def test_escape_attrs_always
+    assert_equal(<<HTML, render(<<HAML, :escape_attrs => :always))
+<div class='"&amp;lt;&amp;gt;&amp;amp;"' id='foo'>
+  bar
+</div>
+HTML
+#foo{:class => '"&lt;&gt;&amp;"'}
+  bar
+HAML
+  end
+
   def test_escape_html
     html = <<HTML
 &amp;

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification 
 name: haml
 version: !ruby/object:Gem::Version 
-  version: 3.1.0.alpha.17
+  version: 3.1.0.alpha.18
 platform: ruby
 authors: 
 - Nathan Weizenbaum
@@ -10,7 +10,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2010-10-11 00:00:00 -04:00
+date: 2010-10-12 00:00:00 -04:00
 default_executable: 
 dependencies: 
 - !ruby/object:Gem::Dependency