@webtides/element-js 1.2.0 → 1.2.1

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@webtides/element-js",
-    "version": "1.2.0",
+    "version": "1.2.1",
     "module": "index.js",
     "main": "index.js",
     "type": "module",

package/src/dom-parts/TemplateResult.js

@@ -6,7 +6,7 @@ const voidElements = /^(?:area|base|br|col|embed|hr|img|input|link|meta|source|t
 const rawTextElements = /<(script|style|textarea|title)([^>]*)>(.*?)<\/\1>/i;
 const elements = /<([a-z]+[a-z0-9:._-]*)([^>]*?)(\/?)>/g;
 // TODO: v this will not match any values with escaped quotes like onClick='console.log("\'test")'
-const attributes = /([^\s]*)=((?:")[^"]*(?:")|(?:')[^']*(?:')|[^\s\/>]*)|([^\s\/>]*)/g;
+const attributes = /([^\s=]*)=((?:")[^"]*(?:")|(?:')[^']*(?:')|[^\s\/>]*)|([^\s\/>]*)/g;
 const partPositions = /[\x01\x02]/g;
 const ssrPlaceholder = /{{dom-part\?(.*?)}}/g;
 // \x01 Node.ELEMENT_NODE

package/src/util/AttributeParser.js

@@ -125,16 +125,20 @@ export function camelToDash(string) {
 }
 
 /**
- * Decodes an attribute according to {@link https://html.spec.whatwg.org/multipage/syntax.html#attributes-2}
+ * Decodes an attribute according to {@link https://html.spec.whatwg.org/multipage/syntax.html#attributes-2} & {@link https://html.spec.whatwg.org/multipage/parsing.html#escapingString}
  * @param {string} attribute
  * @returns {string}
  */
 export function decodeAttribute(attribute) {
-    return `${attribute}`.replace(/"/g, '"').replace(/&/g, '&');
+    return `${attribute}`
+        .replace(/&lt;/g, '<')
+        .replace(/&gt;/g, '>')
+        .replace(/&quot;/g, '"')
+        .replace(/&amp;/g, '&');
 }
 
 /**
- * Encodes an attribute according to {@link https://html.spec.whatwg.org/multipage/syntax.html#attributes-2}
+ * Encodes an attribute according to {@link https://html.spec.whatwg.org/multipage/syntax.html#attributes-2} & {@link https://html.spec.whatwg.org/multipage/parsing.html#escapingString}
  * @param {string} attribute
  * @returns {string}
  */
@@ -142,6 +146,8 @@ export function encodeAttribute(attribute) {
     return `${attribute}`
         .replace(/&/g, '&amp;')
         .replace(/"/g, '&quot;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
         .replace(/\r\n/g, '\n')
         .replace(/[\r\n]/g, '\n');
 }