@beyondwork/docx-react-component 1.0.41 → 1.0.42

package/src/io/export/serialize-headers-footers.ts

@@ -17,6 +17,7 @@ import {
   serializeTableRowPropertiesXml,
 } from "./table-properties-xml.ts";
 import { twip } from "./twip.ts";
+import { escapeXmlAttribute } from "./escape-xml-attribute.ts";
 
 export const WORD_HEADER_CONTENT_TYPE =
   "application/vnd.openxmlformats-officedocument.wordprocessingml.header+xml";
@@ -178,7 +179,7 @@ function buildParagraphPropertiesXml(paragraph: ParagraphNode): string {
   const parts: string[] = [];
 
   if (paragraph.styleId) {
-    parts.push(`<w:pStyle w:val="${escapeAttribute(paragraph.styleId)}"/>`);
+    parts.push(`<w:pStyle w:val="${escapeXmlAttribute(paragraph.styleId)}"/>`);
   }
   if (paragraph.spacing) {
     const s = paragraph.spacing;
@@ -186,7 +187,7 @@ function buildParagraphPropertiesXml(paragraph: ParagraphNode): string {
     if (s.before !== undefined) attrs.push(`w:before="${twip(s.before)}"`);
     if (s.after !== undefined) attrs.push(`w:after="${twip(s.after)}"`);
     if (s.line !== undefined) attrs.push(`w:line="${twip(s.line)}"`);
-    if (s.lineRule) attrs.push(`w:lineRule="${escapeAttribute(s.lineRule)}"`);
+    if (s.lineRule) attrs.push(`w:lineRule="${escapeXmlAttribute(s.lineRule)}"`);
     if (attrs.length > 0) parts.push(`<w:spacing ${attrs.join(" ")}/>`);
   }
   if (paragraph.indentation) {
@@ -199,11 +200,11 @@ function buildParagraphPropertiesXml(paragraph: ParagraphNode): string {
     if (attrs.length > 0) parts.push(`<w:ind ${attrs.join(" ")}/>`);
   }
   if (paragraph.alignment) {
-    parts.push(`<w:jc w:val="${escapeAttribute(paragraph.alignment)}"/>`);
+    parts.push(`<w:jc w:val="${escapeXmlAttribute(paragraph.alignment)}"/>`);
   }
   if (paragraph.tabStops && paragraph.tabStops.length > 0) {
     const tabsXml = paragraph.tabStops.map((tab) => {
-      const leaderAttr = tab.leader ? ` w:leader="${escapeAttribute(tab.leader)}"` : "";
+      const leaderAttr = tab.leader ? ` w:leader="${escapeXmlAttribute(tab.leader)}"` : "";
       return `<w:tab w:val="${tab.align}" w:pos="${twip(tab.position)}"${leaderAttr}/>`;
     }).join("");
     parts.push(`<w:tabs>${tabsXml}</w:tabs>`);
@@ -228,14 +229,14 @@ function serializeInlineNode(node: InlineNode): string {
     case "footnote_ref": {
       const refElement =
         node.noteKind === "footnote"
-          ? `<w:footnoteReference w:id="${escapeAttribute(node.noteId)}"/>`
-          : `<w:endnoteReference w:id="${escapeAttribute(node.noteId)}"/>`;
+          ? `<w:footnoteReference w:id="${escapeXmlAttribute(node.noteId)}"/>`
+          : `<w:endnoteReference w:id="${escapeXmlAttribute(node.noteId)}"/>`;
       return `<w:r><w:rPr><w:rStyle w:val="${node.noteKind === "footnote" ? "FootnoteReference" : "EndnoteReference"}"/></w:rPr>${refElement}</w:r>`;
     }
     case "bookmark_start":
-      return `<w:bookmarkStart w:id="${escapeAttribute(node.bookmarkId)}" w:name="${escapeAttribute(node.name)}"/>`;
+      return `<w:bookmarkStart w:id="${escapeXmlAttribute(node.bookmarkId)}" w:name="${escapeXmlAttribute(node.name)}"/>`;
     case "bookmark_end":
-      return `<w:bookmarkEnd w:id="${escapeAttribute(node.bookmarkId)}"/>`;
+      return `<w:bookmarkEnd w:id="${escapeXmlAttribute(node.bookmarkId)}"/>`;
     case "field":
       if (node.children && node.children.length > 0) {
         const childrenXml = node.children.map((child) => serializeInlineNode(child)).join("");
@@ -248,10 +249,10 @@ function serializeInlineNode(node: InlineNode): string {
             `<w:r><w:fldChar w:fldCharType="end"/></w:r>`
           );
         }
-        return `<w:fldSimple w:instr="${escapeAttribute(node.instruction)}">${childrenXml}</w:fldSimple>`;
+        return `<w:fldSimple w:instr="${escapeXmlAttribute(node.instruction)}">${childrenXml}</w:fldSimple>`;
       }
       if (node.fieldType === "simple") {
-        return `<w:fldSimple w:instr="${escapeAttribute(node.instruction)}"/>`;
+        return `<w:fldSimple w:instr="${escapeXmlAttribute(node.instruction)}"/>`;
       }
       return `<w:r><w:fldChar w:fldCharType="begin"/></w:r><w:r><w:instrText xml:space="preserve">${escapeXml(node.instruction)}</w:instrText></w:r><w:r><w:fldChar w:fldCharType="separate"/></w:r><w:r><w:fldChar w:fldCharType="end"/></w:r>`;
     case "hyperlink":
@@ -301,19 +302,19 @@ function buildRunPropertiesXml(marks: TextMark[] | undefined): string {
         parts.push("<w:dstrike/>");
         break;
       case "fontFamily":
-        parts.push(`<w:rFonts w:ascii="${escapeAttribute(mark.val)}" w:hAnsi="${escapeAttribute(mark.val)}"/>`);
+        parts.push(`<w:rFonts w:ascii="${escapeXmlAttribute(mark.val)}" w:hAnsi="${escapeXmlAttribute(mark.val)}"/>`);
         break;
       case "fontSize":
         parts.push(`<w:sz w:val="${twip(mark.val)}"/>`);
         break;
       case "textColor":
-        parts.push(`<w:color w:val="${escapeAttribute(mark.color)}"/>`);
+        parts.push(`<w:color w:val="${escapeXmlAttribute(mark.color)}"/>`);
         break;
       case "highlight":
-        parts.push(`<w:highlight w:val="${escapeAttribute(mark.val)}"/>`);
+        parts.push(`<w:highlight w:val="${escapeXmlAttribute(mark.val)}"/>`);
         break;
       case "backgroundColor":
-        parts.push(`<w:shd w:val="clear" w:color="auto" w:fill="${escapeAttribute(mark.color)}"/>`);
+        parts.push(`<w:shd w:val="clear" w:color="auto" w:fill="${escapeXmlAttribute(mark.color)}"/>`);
         break;
       case "smallCaps":
         parts.push("<w:smallCaps/>");
@@ -345,23 +346,15 @@ function escapeXml(text: string): string {
     .replace(/>/g, "&gt;");
 }
 
-function escapeAttribute(value: string): string {
-  return value
-    .replace(/&/g, "&amp;")
-    .replace(/</g, "&lt;")
-    .replace(/>/g, "&gt;")
-    .replace(/"/g, "&quot;");
-}
-
 function serializeHyperlinkNode(node: Extract<InlineNode, { type: "hyperlink" }>): string {
   const childrenXml = node.children.map((child) => serializeInlineNode(child)).join("");
   if (node.href.startsWith("#")) {
-    return `<w:hyperlink w:anchor="${escapeAttribute(node.href.slice(1))}">${childrenXml}</w:hyperlink>`;
+    return `<w:hyperlink w:anchor="${escapeXmlAttribute(node.href.slice(1))}">${childrenXml}</w:hyperlink>`;
   }
   if (!/^rId[A-Za-z0-9._-]+$/u.test(node.href)) {
     throw new Error("Cannot safely serialize URL-backed header/footer hyperlinks without relationship context.");
   }
-  return `<w:hyperlink r:id="${escapeAttribute(node.href)}">${childrenXml}</w:hyperlink>`;
+  return `<w:hyperlink r:id="${escapeXmlAttribute(node.href)}">${childrenXml}</w:hyperlink>`;
 }
 
 function buildTableCellPropertiesXml(cell: TableCellNode): string {

package/src/io/export/serialize-main-document.ts

@@ -24,6 +24,7 @@ import {
   serializeTableRowPropertiesXml,
 } from "./table-properties-xml.ts";
 import { twip } from "./twip.ts";
+import { escapeXmlAttribute } from "./escape-xml-attribute.ts";
 
 const HYPERLINK_RELATIONSHIP_TYPE =
   "http://schemas.openxmlformats.org/officeDocument/2006/relationships/hyperlink";
@@ -338,10 +339,10 @@ function serializeCustomXmlNode(
   }
   const attrs: string[] = [];
   if (block.uri) {
-    attrs.push(`w:uri="${escapeAttribute(block.uri)}"`);
+    attrs.push(`w:uri="${escapeXmlAttribute(block.uri)}"`);
   }
   if (block.element) {
-    attrs.push(`w:element="${escapeAttribute(block.element)}"`);
+    attrs.push(`w:element="${escapeXmlAttribute(block.element)}"`);
   }
   const attrXml = attrs.length > 0 ? ` ${attrs.join(" ")}` : "";
   const childrenXml = block.children.map((child) => serializeBlockNode(child, state)).join("");
@@ -351,19 +352,19 @@ function serializeCustomXmlNode(
 function serializeAltChunkNode(
   block: AltChunkNode,
 ): string {
-  return `<w:altChunk r:id="${escapeAttribute(block.relationshipId)}"/>`;
+  return `<w:altChunk r:id="${escapeXmlAttribute(block.relationshipId)}"/>`;
 }
 
 function buildSdtPropertiesXml(block: SdtNode): string {
   const children: string[] = [];
   if (block.properties.alias) {
-    children.push(`<w:alias w:val="${escapeAttribute(block.properties.alias)}"/>`);
+    children.push(`<w:alias w:val="${escapeXmlAttribute(block.properties.alias)}"/>`);
   }
   if (block.properties.tag) {
-    children.push(`<w:tag w:val="${escapeAttribute(block.properties.tag)}"/>`);
+    children.push(`<w:tag w:val="${escapeXmlAttribute(block.properties.tag)}"/>`);
   }
   if (block.properties.lock) {
-    children.push(`<w:lock w:val="${escapeAttribute(block.properties.lock)}"/>`);
+    children.push(`<w:lock w:val="${escapeXmlAttribute(block.properties.lock)}"/>`);
   }
   if (block.properties.showingPlcHdr) {
     children.push(`<w:showingPlcHdr/>`);
@@ -374,26 +375,26 @@ function buildSdtPropertiesXml(block: SdtNode): string {
     // ST_OnOff (A.3): w14:val is typed as ST_OnOff; emit "true"/"false"
     // instead of "1"/"0" to satisfy DocumentFormat.OpenXml validation.
     cbParts.push(`<w14:checked w14:val="${cb.checked ? "true" : "false"}"/>`);
-    if (cb.checkedChar) cbParts.push(`<w14:checkedState w14:val="${escapeAttribute(cb.checkedChar)}"/>`);
-    if (cb.uncheckedChar) cbParts.push(`<w14:uncheckedState w14:val="${escapeAttribute(cb.uncheckedChar)}"/>`);
+    if (cb.checkedChar) cbParts.push(`<w14:checkedState w14:val="${escapeXmlAttribute(cb.checkedChar)}"/>`);
+    if (cb.uncheckedChar) cbParts.push(`<w14:uncheckedState w14:val="${escapeXmlAttribute(cb.uncheckedChar)}"/>`);
     children.push(`<w14:checkbox>${cbParts.join("")}</w14:checkbox>`);
   } else if (block.properties.datePicker) {
     const dp = block.properties.datePicker;
-    const dateAttrs = dp.fullDate ? ` w:fullDate="${escapeAttribute(dp.fullDate)}"` : "";
+    const dateAttrs = dp.fullDate ? ` w:fullDate="${escapeXmlAttribute(dp.fullDate)}"` : "";
     const dpParts: string[] = [];
-    if (dp.dateFormat) dpParts.push(`<w:dateFormat w:val="${escapeAttribute(dp.dateFormat)}"/>`);
-    if (dp.lid) dpParts.push(`<w:lid w:val="${escapeAttribute(dp.lid)}"/>`);
+    if (dp.dateFormat) dpParts.push(`<w:dateFormat w:val="${escapeXmlAttribute(dp.dateFormat)}"/>`);
+    if (dp.lid) dpParts.push(`<w:lid w:val="${escapeXmlAttribute(dp.lid)}"/>`);
     children.push(dpParts.length > 0 ? `<w:date${dateAttrs}>${dpParts.join("")}</w:date>` : `<w:date${dateAttrs}/>`);
   } else if (block.properties.dropdownList) {
     const items = block.properties.dropdownList.map((item) => {
-      const dt = item.displayText ? ` w:displayText="${escapeAttribute(item.displayText)}"` : "";
-      return `<w:listItem${dt} w:value="${escapeAttribute(item.value)}"/>`;
+      const dt = item.displayText ? ` w:displayText="${escapeXmlAttribute(item.displayText)}"` : "";
+      return `<w:listItem${dt} w:value="${escapeXmlAttribute(item.value)}"/>`;
     }).join("");
     children.push(`<w:dropDownList>${items}</w:dropDownList>`);
   } else if (block.properties.comboBox) {
     const items = block.properties.comboBox.map((item) => {
-      const dt = item.displayText ? ` w:displayText="${escapeAttribute(item.displayText)}"` : "";
-      return `<w:listItem${dt} w:value="${escapeAttribute(item.value)}"/>`;
+      const dt = item.displayText ? ` w:displayText="${escapeXmlAttribute(item.displayText)}"` : "";
+      return `<w:listItem${dt} w:value="${escapeXmlAttribute(item.value)}"/>`;
     }).join("");
     children.push(`<w:comboBox>${items}</w:comboBox>`);
   } else if (block.properties.sdtType === "plainText") {
@@ -514,8 +515,8 @@ function serializeTableInlineNode(
       return "<w:r><w:br/></w:r>";
     case "symbol": {
       const properties = serializeRunPropertiesFromMarks(node.marks);
-      const fontAttribute = node.font ? ` w:font="${escapeAttribute(node.font)}"` : "";
-      return `<w:r>${properties}<w:sym${fontAttribute} w:char="${escapeAttribute(node.char)}"/></w:r>`;
+      const fontAttribute = node.font ? ` w:font="${escapeXmlAttribute(node.font)}"` : "";
+      return `<w:r>${properties}<w:sym${fontAttribute} w:char="${escapeXmlAttribute(node.char)}"/></w:r>`;
     }
     case "image":
       return serializeImageNode(node, state);
@@ -529,7 +530,7 @@ function serializeTableInlineNode(
       return wrapInlineRawXml(node.rawXml);
     case "hyperlink": {
       const hyperlinkOpen = node.href.startsWith("#")
-        ? `<w:hyperlink w:anchor="${escapeAttribute(node.href.slice(1))}">`
+        ? `<w:hyperlink w:anchor="${escapeXmlAttribute(node.href.slice(1))}">`
         : (() => {
             const relationshipId = `rIdHyperlink${state.nextHyperlinkRelationshipIndex}`;
             state.nextHyperlinkRelationshipIndex += 1;
@@ -559,22 +560,22 @@ function serializeTableInlineNode(
             `<w:r><w:fldChar w:fldCharType="end"/></w:r>`
           );
         }
-        return `<w:fldSimple w:instr="${escapeAttribute(node.instruction)}">${childrenXml}</w:fldSimple>`;
+        return `<w:fldSimple w:instr="${escapeXmlAttribute(node.instruction)}">${childrenXml}</w:fldSimple>`;
       }
-      return `<w:fldSimple w:instr="${escapeAttribute(node.instruction)}"/>`;
+      return `<w:fldSimple w:instr="${escapeXmlAttribute(node.instruction)}"/>`;
     }
     case "bookmark_start":
       return (
-        `<w:bookmarkStart w:id="${escapeAttribute(node.bookmarkId)}"` +
-        ` w:name="${escapeAttribute(node.name)}"/>`
+        `<w:bookmarkStart w:id="${escapeXmlAttribute(node.bookmarkId)}"` +
+        ` w:name="${escapeXmlAttribute(node.name)}"/>`
       );
     case "bookmark_end":
-      return `<w:bookmarkEnd w:id="${escapeAttribute(node.bookmarkId)}"/>`;
+      return `<w:bookmarkEnd w:id="${escapeXmlAttribute(node.bookmarkId)}"/>`;
     case "footnote_ref": {
       const refElement =
         node.noteKind === "footnote"
-          ? `<w:footnoteReference w:id="${escapeAttribute(node.noteId)}"/>`
-          : `<w:endnoteReference w:id="${escapeAttribute(node.noteId)}"/>`;
+          ? `<w:footnoteReference w:id="${escapeXmlAttribute(node.noteId)}"/>`
+          : `<w:endnoteReference w:id="${escapeXmlAttribute(node.noteId)}"/>`;
       const styleVal =
         node.noteKind === "footnote"
           ? "FootnoteReference"
@@ -590,7 +591,7 @@ function buildParagraphPropertiesXml(paragraph: ParagraphNode): string {
   const children: string[] = [];
 
   if (paragraph.styleId) {
-    children.push(`<w:pStyle w:val="${escapeAttribute(paragraph.styleId)}"/>`);
+    children.push(`<w:pStyle w:val="${escapeXmlAttribute(paragraph.styleId)}"/>`);
   }
   if (paragraph.keepNext) {
     children.push("<w:keepNext/>");
@@ -662,7 +663,7 @@ function buildParagraphPropertiesXml(paragraph: ParagraphNode): string {
     children.push("<w:suppressLineNumbers/>");
   }
   if (paragraph.cnfStyle) {
-    children.push(`<w:cnfStyle w:val="${escapeAttribute(paragraph.cnfStyle)}"/>`);
+    children.push(`<w:cnfStyle w:val="${escapeXmlAttribute(paragraph.cnfStyle)}"/>`);
   }
   if (paragraph.tabStops && paragraph.tabStops.length > 0) {
     const tabsXml = paragraph.tabStops.map((tab) => {
@@ -706,10 +707,10 @@ function serializeBorder(name: string, border: BorderSpec | undefined): string {
     return "";
   }
   const attrs: string[] = [];
-  if (border.value) attrs.push(`w:val="${escapeAttribute(border.value)}"`);
+  if (border.value) attrs.push(`w:val="${escapeXmlAttribute(border.value)}"`);
   if (border.size !== undefined) attrs.push(`w:sz="${twip(border.size)}"`);
   if (border.space !== undefined) attrs.push(`w:space="${twip(border.space)}"`);
-  if (border.color) attrs.push(`w:color="${escapeAttribute(border.color)}"`);
+  if (border.color) attrs.push(`w:color="${escapeXmlAttribute(border.color)}"`);
   return attrs.length > 0 ? `<w:${name} ${attrs.join(" ")}/>` : "";
 }
 
@@ -718,13 +719,13 @@ function serializeParagraphShading(shading: ParagraphNode["shading"]): string {
     return "";
   }
   const attrs: string[] = [];
-  if (shading.val) attrs.push(`w:val="${escapeAttribute(shading.val)}"`);
-  if (shading.color) attrs.push(`w:color="${escapeAttribute(shading.color)}"`);
+  if (shading.val) attrs.push(`w:val="${escapeXmlAttribute(shading.val)}"`);
+  if (shading.color) attrs.push(`w:color="${escapeXmlAttribute(shading.color)}"`);
   // A.9: w:shd w:val="clear" must always carry w:fill. Emit w:fill="auto"
   // when the canonical model has no explicit fill; otherwise the SDK
   // flags the shading as incomplete.
   if (shading.fill !== undefined) {
-    attrs.push(`w:fill="${escapeAttribute(shading.fill)}"`);
+    attrs.push(`w:fill="${escapeXmlAttribute(shading.fill)}"`);
   } else if (shading.val === "clear") {
     attrs.push(`w:fill="auto"`);
   }
@@ -946,7 +947,7 @@ function serializeInlineNode(
     }
     case "hyperlink": {
       const hyperlinkOpen = node.href.startsWith("#")
-        ? `<w:hyperlink w:anchor="${escapeAttribute(node.href.slice(1))}">`
+        ? `<w:hyperlink w:anchor="${escapeXmlAttribute(node.href.slice(1))}">`
         : (() => {
             const relationshipId = `rIdHyperlink${state.nextHyperlinkRelationshipIndex}`;
             state.nextHyperlinkRelationshipIndex += 1;
@@ -1015,7 +1016,7 @@ function serializeInlineNode(
         }
 
         // Simple field with children
-        const openXml = `<w:fldSimple w:instr="${escapeAttribute(node.instruction)}">`;
+        const openXml = `<w:fldSimple w:instr="${escapeXmlAttribute(node.instruction)}">`;
         nextOffset += openXml.length;
         const children: string[] = [openXml];
         for (const child of node.children) {
@@ -1033,7 +1034,7 @@ function serializeInlineNode(
         return { xml: children.join(""), cursor: nextCursor, boundaries };
       }
 
-      const xml = `<w:fldSimple w:instr="${escapeAttribute(node.instruction)}"/>`;
+      const xml = `<w:fldSimple w:instr="${escapeXmlAttribute(node.instruction)}"/>`;
       const boundaries = new Map<number, number>();
       boundaries.set(cursor, xmlOffset);
       boundaries.set(cursor + 1, xmlOffset + xml.length);
@@ -1045,15 +1046,15 @@ function serializeInlineNode(
     }
     case "bookmark_start": {
       const xml =
-        `<w:bookmarkStart w:id="${escapeAttribute(node.bookmarkId)}"` +
-        ` w:name="${escapeAttribute(node.name)}"/>`;
+        `<w:bookmarkStart w:id="${escapeXmlAttribute(node.bookmarkId)}"` +
+        ` w:name="${escapeXmlAttribute(node.name)}"/>`;
       const boundaries = new Map<number, number>();
       boundaries.set(cursor, xmlOffset);
       boundaries.set(cursor, xmlOffset + xml.length);
       return { xml, cursor, boundaries };
     }
     case "bookmark_end": {
-      const xml = `<w:bookmarkEnd w:id="${escapeAttribute(node.bookmarkId)}"/>`;
+      const xml = `<w:bookmarkEnd w:id="${escapeXmlAttribute(node.bookmarkId)}"/>`;
       const boundaries = new Map<number, number>();
       boundaries.set(cursor, xmlOffset);
       boundaries.set(cursor, xmlOffset + xml.length);
@@ -1062,8 +1063,8 @@ function serializeInlineNode(
     case "footnote_ref": {
       const refElement =
         node.noteKind === "footnote"
-          ? `<w:footnoteReference w:id="${escapeAttribute(node.noteId)}"/>`
-          : `<w:endnoteReference w:id="${escapeAttribute(node.noteId)}"/>`;
+          ? `<w:footnoteReference w:id="${escapeXmlAttribute(node.noteId)}"/>`
+          : `<w:endnoteReference w:id="${escapeXmlAttribute(node.noteId)}"/>`;
       const styleVal =
         node.noteKind === "footnote"
           ? "FootnoteReference"
@@ -1098,7 +1099,7 @@ function serializeImageNode(
   const mediaItem = state.media.items[node.mediaId];
   if (mediaItem?.relationshipId && state.existingRelationshipMap.has(mediaItem.relationshipId)) {
     const altText = node.altText ?? mediaItem.altText ?? mediaItem.filename;
-    return `<w:r><w:drawing><wp:inline xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" xmlns:pic="http://schemas.openxmlformats.org/drawingml/2006/picture" xmlns:wp="http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing"><wp:extent cx="9525" cy="9525"/><wp:docPr id="1" name="${escapeAttribute(mediaItem.filename)}" descr="${escapeAttribute(altText ?? "")}"/><wp:cNvGraphicFramePr/><a:graphic><a:graphicData uri="http://schemas.openxmlformats.org/drawingml/2006/picture"><pic:pic><pic:nvPicPr><pic:cNvPr id="0" name="${escapeAttribute(mediaItem.filename)}"/><pic:cNvPicPr/></pic:nvPicPr><pic:blipFill><a:blip r:embed="${escapeAttribute(mediaItem.relationshipId)}"/><a:stretch><a:fillRect/></a:stretch></pic:blipFill><pic:spPr><a:xfrm><a:off x="0" y="0"/><a:ext cx="9525" cy="9525"/></a:xfrm><a:prstGeom prst="rect"><a:avLst/></a:prstGeom></pic:spPr></pic:pic></a:graphicData></a:graphic></wp:inline></w:drawing></w:r>`;
+    return `<w:r><w:drawing><wp:inline xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" xmlns:pic="http://schemas.openxmlformats.org/drawingml/2006/picture" xmlns:wp="http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing"><wp:extent cx="9525" cy="9525"/><wp:docPr id="1" name="${escapeXmlAttribute(mediaItem.filename)}" descr="${escapeXmlAttribute(altText ?? "")}"/><wp:cNvGraphicFramePr/><a:graphic><a:graphicData uri="http://schemas.openxmlformats.org/drawingml/2006/picture"><pic:pic><pic:nvPicPr><pic:cNvPr id="0" name="${escapeXmlAttribute(mediaItem.filename)}"/><pic:cNvPicPr/></pic:nvPicPr><pic:blipFill><a:blip r:embed="${escapeXmlAttribute(mediaItem.relationshipId)}"/><a:stretch><a:fillRect/></a:stretch></pic:blipFill><pic:spPr><a:xfrm><a:off x="0" y="0"/><a:ext cx="9525" cy="9525"/></a:xfrm><a:prstGeom prst="rect"><a:avLst/></a:prstGeom></pic:spPr></pic:pic></a:graphicData></a:graphic></wp:inline></w:drawing></w:r>`;
   }
 
   return serializeRun({
@@ -1141,14 +1142,14 @@ function serializeRunProperties(marks: TextMark[] | undefined): string {
         markParts.push("<w:vanish/>");
         break;
       case "lang":
-        markParts.push(`<w:lang w:val="${escapeAttribute(mark.val)}"/>`);
+        markParts.push(`<w:lang w:val="${escapeXmlAttribute(mark.val)}"/>`);
         break;
       case "highlight":
-        markParts.push(`<w:highlight w:val="${escapeAttribute(mark.val)}"/>`);
+        markParts.push(`<w:highlight w:val="${escapeXmlAttribute(mark.val)}"/>`);
         break;
       case "backgroundColor":
         markParts.push(
-          `<w:shd w:val="clear" w:color="auto" w:fill="${escapeAttribute(mark.color)}"/>`,
+          `<w:shd w:val="clear" w:color="auto" w:fill="${escapeXmlAttribute(mark.color)}"/>`,
         );
         break;
       case "charSpacing":
@@ -1173,13 +1174,13 @@ function serializeRunProperties(marks: TextMark[] | undefined): string {
         markParts.push(mark.xml);
         break;
       case "fontFamily":
-        markParts.push(`<w:rFonts w:ascii="${escapeAttribute(mark.val)}" w:hAnsi="${escapeAttribute(mark.val)}"/>`);
+        markParts.push(`<w:rFonts w:ascii="${escapeXmlAttribute(mark.val)}" w:hAnsi="${escapeXmlAttribute(mark.val)}"/>`);
         break;
       case "fontSize":
         markParts.push(`<w:sz w:val="${mark.val}"/>`);
         break;
       case "textColor":
-        markParts.push(`<w:color w:val="${escapeAttribute(mark.color)}"/>`);
+        markParts.push(`<w:color w:val="${escapeXmlAttribute(mark.color)}"/>`);
         break;
       case "smallCaps":
         markParts.push("<w:smallCaps/>");
@@ -1228,10 +1229,6 @@ function escapeXml(value: string): string {
     .replace(/>/g, "&gt;");
 }
 
-function escapeAttribute(value: string): string {
-  return escapeXml(value).replace(/"/g, "&quot;");
-}
-
 function offsetParagraphBoundary(
   boundary: RevisionParagraphBoundary,
   offset: number,
@@ -1426,7 +1423,7 @@ export function renderDeterministicRootAttributes(
     ...otherEntries,
   ];
   return ordered
-    .map(([name, value]) => ` ${name}="${escapeAttribute(value)}"`)
+    .map(([name, value]) => ` ${name}="${escapeXmlAttribute(value)}"`)
     .join("");
 }
 
@@ -1436,20 +1433,20 @@ export function serializeSectionPropertiesXml(props: SectionProperties): string
   // Header references
   if (props.headerReferences) {
     for (const ref of props.headerReferences) {
-      children.push(`<w:headerReference w:type="${escapeAttribute(ref.variant)}" r:id="${escapeAttribute(ref.relationshipId)}"/>`);
+      children.push(`<w:headerReference w:type="${escapeXmlAttribute(ref.variant)}" r:id="${escapeXmlAttribute(ref.relationshipId)}"/>`);
     }
   }
 
   // Footer references
   if (props.footerReferences) {
     for (const ref of props.footerReferences) {
-      children.push(`<w:footerReference w:type="${escapeAttribute(ref.variant)}" r:id="${escapeAttribute(ref.relationshipId)}"/>`);
+      children.push(`<w:footerReference w:type="${escapeXmlAttribute(ref.variant)}" r:id="${escapeXmlAttribute(ref.relationshipId)}"/>`);
     }
   }
 
   // Section type
   if (props.sectionType) {
-    children.push(`<w:type w:val="${escapeAttribute(props.sectionType)}"/>`);
+    children.push(`<w:type w:val="${escapeXmlAttribute(props.sectionType)}"/>`);
   }
 
   // Page size
@@ -1502,10 +1499,10 @@ export function serializeSectionPropertiesXml(props: SectionProperties): string
   // Page numbering
   if (props.pageNumbering) {
     let pgNum = "<w:pgNumType";
-    if (props.pageNumbering.format) pgNum += ` w:fmt="${escapeAttribute(props.pageNumbering.format)}"`;
+    if (props.pageNumbering.format) pgNum += ` w:fmt="${escapeXmlAttribute(props.pageNumbering.format)}"`;
     if (props.pageNumbering.start !== undefined) pgNum += ` w:start="${twip(props.pageNumbering.start)}"`;
-    if (props.pageNumbering.chapStyle) pgNum += ` w:chapStyle="${escapeAttribute(props.pageNumbering.chapStyle)}"`;
-    if (props.pageNumbering.chapSep) pgNum += ` w:chapSep="${escapeAttribute(props.pageNumbering.chapSep)}"`;
+    if (props.pageNumbering.chapStyle) pgNum += ` w:chapStyle="${escapeXmlAttribute(props.pageNumbering.chapStyle)}"`;
+    if (props.pageNumbering.chapSep) pgNum += ` w:chapSep="${escapeXmlAttribute(props.pageNumbering.chapSep)}"`;
     pgNum += "/>";
     children.push(pgNum);
   }
@@ -1522,7 +1519,7 @@ export function serializeSectionPropertiesXml(props: SectionProperties): string
       lineNumbering += ` w:distance="${twip(props.lineNumbering.distance)}"`;
     }
     if (props.lineNumbering.restart) {
-      lineNumbering += ` w:restart="${escapeAttribute(props.lineNumbering.restart)}"`;
+      lineNumbering += ` w:restart="${escapeXmlAttribute(props.lineNumbering.restart)}"`;
     }
     lineNumbering += "/>";
     children.push(lineNumbering);
@@ -1531,13 +1528,13 @@ export function serializeSectionPropertiesXml(props: SectionProperties): string
   if (props.pageBorders) {
     const attrs: string[] = [];
     if (props.pageBorders.offsetFrom) {
-      attrs.push(`w:offsetFrom="${escapeAttribute(props.pageBorders.offsetFrom)}"`);
+      attrs.push(`w:offsetFrom="${escapeXmlAttribute(props.pageBorders.offsetFrom)}"`);
     }
     if (props.pageBorders.display) {
-      attrs.push(`w:display="${escapeAttribute(props.pageBorders.display)}"`);
+      attrs.push(`w:display="${escapeXmlAttribute(props.pageBorders.display)}"`);
     }
     if (props.pageBorders.zOrder) {
-      attrs.push(`w:zOrder="${escapeAttribute(props.pageBorders.zOrder)}"`);
+      attrs.push(`w:zOrder="${escapeXmlAttribute(props.pageBorders.zOrder)}"`);
     }
     const borderXml = [
       serializeBorder("top", props.pageBorders.top),
@@ -1560,7 +1557,7 @@ export function serializeSectionPropertiesXml(props: SectionProperties): string
   if (props.documentGrid) {
     const attrs: string[] = [];
     if (props.documentGrid.type) {
-      attrs.push(`w:type="${escapeAttribute(props.documentGrid.type)}"`);
+      attrs.push(`w:type="${escapeXmlAttribute(props.documentGrid.type)}"`);
     }
     if (props.documentGrid.linePitch !== undefined) {
       attrs.push(`w:linePitch="${props.documentGrid.linePitch}"`);

package/src/io/export/serialize-numbering.ts

@@ -5,6 +5,7 @@ import {
 } from "../ooxml/numbering-sentinels.ts";
 import { buildRunPropertiesXml } from "./serialize-run-formatting.ts";
 import { twip } from "./twip.ts";
+import { escapeXmlAttribute } from "./escape-xml-attribute.ts";
 
 export const WORD_NUMBERING_CONTENT_TYPE =
   "application/vnd.openxmlformats-officedocument.wordprocessingml.numbering+xml";
@@ -50,7 +51,7 @@ export function serializeParagraphNumberingProperties(
     return "";
   }
 
-  return `<w:numPr><w:ilvl w:val="${clampIlvl(numbering.level)}"/><w:numId w:val="${escapeAttribute(
+  return `<w:numPr><w:ilvl w:val="${clampIlvl(numbering.level)}"/><w:numId w:val="${escapeXmlAttribute(
     clampNonNegativeIdString(
       stripCanonicalPrefix(numbering.numberingInstanceId, "num:"),
     ),
@@ -58,7 +59,7 @@ export function serializeParagraphNumberingProperties(
 }
 
 function serializeAbstractDefinition(definition: NumberingCatalog["abstractDefinitions"][string]): string {
-  const abstractNumId = escapeAttribute(
+  const abstractNumId = escapeXmlAttribute(
     clampNonNegativeIdString(
       stripCanonicalPrefix(definition.abstractNumberingId, "abstract-num:"),
     ),
@@ -67,19 +68,19 @@ function serializeAbstractDefinition(definition: NumberingCatalog["abstractDefin
   // ECMA-376 abstractNum child order: nsid, multiLevelType, tmpl, styleLink,
   // numStyleLink — all before the <w:lvl> children.
   const nsid = definition.nsid
-    ? `<w:nsid w:val="${escapeAttribute(definition.nsid)}"/>`
+    ? `<w:nsid w:val="${escapeXmlAttribute(definition.nsid)}"/>`
     : "";
   const multiLevelType = definition.multiLevelType
-    ? `<w:multiLevelType w:val="${escapeAttribute(definition.multiLevelType)}"/>`
+    ? `<w:multiLevelType w:val="${escapeXmlAttribute(definition.multiLevelType)}"/>`
     : "";
   const tmpl = definition.tplc
-    ? `<w:tmpl w:val="${escapeAttribute(definition.tplc)}"/>`
+    ? `<w:tmpl w:val="${escapeXmlAttribute(definition.tplc)}"/>`
     : "";
   const styleLink = definition.styleLink
-    ? `<w:styleLink w:val="${escapeAttribute(definition.styleLink)}"/>`
+    ? `<w:styleLink w:val="${escapeXmlAttribute(definition.styleLink)}"/>`
     : "";
   const numStyleLink = definition.numStyleLink
-    ? `<w:numStyleLink w:val="${escapeAttribute(definition.numStyleLink)}"/>`
+    ? `<w:numStyleLink w:val="${escapeXmlAttribute(definition.numStyleLink)}"/>`
     : "";
 
   const levels = [...definition.levels]
@@ -100,19 +101,19 @@ function serializeLevel(
     level.startAt !== undefined
       ? `<w:start w:val="${clampStart(level.startAt)}"/>`
       : "";
-  const numFmt = `<w:numFmt w:val="${escapeAttribute(level.format)}"/>`;
+  const numFmt = `<w:numFmt w:val="${escapeXmlAttribute(level.format)}"/>`;
   const lvlRestart =
     level.restartAfterLevel !== undefined
       ? `<w:lvlRestart w:val="${level.restartAfterLevel}"/>`
       : "";
   const paragraphStyle = level.paragraphStyleId
-    ? `<w:pStyle w:val="${escapeAttribute(level.paragraphStyleId)}"/>`
+    ? `<w:pStyle w:val="${escapeXmlAttribute(level.paragraphStyleId)}"/>`
     : "";
   const isLegal = level.isLegalNumbering ? "<w:isLgl/>" : "";
-  const suffix = level.suffix ? `<w:suff w:val="${escapeAttribute(level.suffix)}"/>` : "";
-  const lvlText = `<w:lvlText w:val="${escapeAttribute(level.text)}"/>`;
+  const suffix = level.suffix ? `<w:suff w:val="${escapeXmlAttribute(level.suffix)}"/>` : "";
+  const lvlText = `<w:lvlText w:val="${escapeXmlAttribute(level.text)}"/>`;
   const justification = level.paragraphGeometry?.justification
-    ? `<w:lvlJc w:val="${escapeAttribute(level.paragraphGeometry.justification)}"/>`
+    ? `<w:lvlJc w:val="${escapeXmlAttribute(level.paragraphGeometry.justification)}"/>`
     : "";
   const paragraphProperties = serializeLevelParagraphGeometry(level.paragraphGeometry);
   const runProperties = buildRunPropertiesXml(level.runProperties);
@@ -134,13 +135,13 @@ function serializeLevelOverride(
     level.startAt !== undefined
       ? `<w:start w:val="${clampStart(level.startAt)}"/>`
       : "";
-  const format = level.format ? `<w:numFmt w:val="${escapeAttribute(level.format)}"/>` : "";
+  const format = level.format ? `<w:numFmt w:val="${escapeXmlAttribute(level.format)}"/>` : "";
   const lvlRestart =
     level.restartAfterLevel !== undefined
       ? `<w:lvlRestart w:val="${level.restartAfterLevel}"/>`
       : "";
   const paragraphStyle = level.paragraphStyleId
-    ? `<w:pStyle w:val="${escapeAttribute(level.paragraphStyleId)}"/>`
+    ? `<w:pStyle w:val="${escapeXmlAttribute(level.paragraphStyleId)}"/>`
     : "";
   // ST_OnOff element (A.3):
   // - true  → <w:isLgl/>.
@@ -153,12 +154,12 @@ function serializeLevelOverride(
       : level.isLegalNumbering === false
         ? `<w:isLgl w:val="false"/>`
         : "";
-  const suffix = level.suffix ? `<w:suff w:val="${escapeAttribute(level.suffix)}"/>` : "";
+  const suffix = level.suffix ? `<w:suff w:val="${escapeXmlAttribute(level.suffix)}"/>` : "";
   const text = level.text !== undefined
-    ? `<w:lvlText w:val="${escapeAttribute(level.text)}"/>`
+    ? `<w:lvlText w:val="${escapeXmlAttribute(level.text)}"/>`
     : "";
   const justification = level.paragraphGeometry?.justification
-    ? `<w:lvlJc w:val="${escapeAttribute(level.paragraphGeometry.justification)}"/>`
+    ? `<w:lvlJc w:val="${escapeXmlAttribute(level.paragraphGeometry.justification)}"/>`
     : "";
   const paragraphProperties = serializeLevelParagraphGeometry(level.paragraphGeometry);
   const runProperties = buildRunPropertiesXml(level.runProperties);
@@ -170,10 +171,10 @@ function serializeLevelOverride(
 }
 
 function serializeInstance(instance: NumberingCatalog["instances"][string]): string {
-  const numId = escapeAttribute(
+  const numId = escapeXmlAttribute(
     clampNonNegativeIdString(stripCanonicalPrefix(instance.numberingInstanceId, "num:")),
   );
-  const abstractNumId = escapeAttribute(
+  const abstractNumId = escapeXmlAttribute(
     clampNonNegativeIdString(
       stripCanonicalPrefix(instance.abstractNumberingId, "abstract-num:"),
     ),
@@ -332,11 +333,3 @@ function stripKnownPrefix(value: string): string {
 function stripCanonicalPrefix(value: string, prefix: "abstract-num:" | "num:"): string {
   return value.startsWith(prefix) ? value.slice(prefix.length) : value;
 }
-
-function escapeAttribute(value: string): string {
-  return value
-    .replace(/&/g, "&amp;")
-    .replace(/"/g, "&quot;")
-    .replace(/</g, "&lt;")
-    .replace(/>/g, "&gt;");
-}