rasti 4.1.0-alpha.3 → 4.1.1-alpha.0

package/README.md

@@ -1,7 +1,7 @@
 <p align="center">
     <picture>
-        <source media="(prefers-color-scheme: dark)" srcset="https://cdn.jsdelivr.net/gh/8tentaculos/rasti@v4.1.0-alpha.3/docs/logo-dark.svg">
-        <img alt="Rasti.js" src="https://cdn.jsdelivr.net/gh/8tentaculos/rasti@v4.1.0-alpha.3/docs/logo.svg" height="120">
+        <source media="(prefers-color-scheme: dark)" srcset="https://cdn.jsdelivr.net/gh/8tentaculos/rasti@v4.1.1-alpha.0/docs/logo-dark.svg">
+        <img alt="Rasti.js" src="https://cdn.jsdelivr.net/gh/8tentaculos/rasti@v4.1.1-alpha.0/docs/logo.svg" height="120">
     </picture>
 </p>
 

package/dist/rasti.js

@@ -1710,6 +1710,23 @@
         return fragment.content;
     }
 
+    /**
+     * Characters that terminate an attribute name. A name containing any of them
+     * would let the rest of the value be parsed as markup instead of as a name.
+     * @type {RegExp}
+     * @private
+     */
+    const INVALID_ATTRIBUTE_NAME = /[\s"'>/=]/;
+
+    /**
+     * Escape an attribute value. Values are serialized inside double quotes,
+     * so escaping the double quote keeps the value from terminating the attribute.
+     * @param {string} value Attribute value.
+     * @return {string} Escaped attribute value.
+     * @private
+     */
+    const escapeAttributeValue = value => `${value}`.replace(/"/g, '"');
+
     /**
      * Generate HTML string from attributes object.
      * @param {Object} attributes Object containing attribute names and values.
@@ -1722,12 +1739,14 @@
 
         Object.keys(attributes).forEach(key => {
             let value = attributes[key];
+            // Skip invalid names, they can't be serialized as an attribute.
+            if (INVALID_ATTRIBUTE_NAME.test(key)) return;
 
             if (value === true) {
                 html.push(key);
             } else if (value !== false) {
                 if (value === null || typeof value === 'undefined') value = '';
-                html.push(`${key}="${value}"`);
+                html.push(`${key}="${escapeAttributeValue(value)}"`);
             }
         });