vcti-escapers 1.0.0__tar.gz

vcti_escapers-1.0.0/LICENSE

@@ -0,0 +1,8 @@
+Copyright (c) 2018-2026 Visual Collaboration Technologies Inc.
+All Rights Reserved.
+
+This software is proprietary and confidential. Unauthorized copying,
+distribution, or use of this software, via any medium, is strictly
+prohibited. Access is granted only to authorized VCollab developers
+and individuals explicitly authorized by Visual Collaboration
+Technologies Inc.

vcti_escapers-1.0.0/PKG-INFO

@@ -0,0 +1,162 @@
+Metadata-Version: 2.4
+Name: vcti-escapers
+Version: 1.0.0
+Summary: Escapers for CSV, Markdown, XML, HTML, JSON and URL, each verified against a real parser
+Author: Visual Collaboration Technologies Inc.
+License-Expression: LicenseRef-Proprietary
+Project-URL: Repository, https://github.com/vcollab/vcti-python-escapers
+Project-URL: Changelog, https://github.com/vcollab/vcti-python-escapers/blob/main/CHANGELOG.md
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Requires-Python: <3.15,>=3.12
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Provides-Extra: test
+Requires-Dist: pytest; extra == "test"
+Requires-Dist: pytest-cov; extra == "test"
+Requires-Dist: markdown-it-py; extra == "test"
+Requires-Dist: html5lib; extra == "test"
+Provides-Extra: lint
+Requires-Dist: ruff; extra == "lint"
+Provides-Extra: typecheck
+Requires-Dist: mypy; extra == "typecheck"
+Dynamic: license-file
+
+# Escapers
+
+Escapers for CSV, Markdown, XML, HTML, JSON and URL, each verified against a real parser
+
+## Overview
+
+Text that came from somewhere else — a name, a status, a free-text reason —
+cannot be dropped into a document as it stands. A comma reshapes a CSV row, a
+pipe splits a Markdown table cell, an unescaped quote ends an HTML attribute
+early and starts whatever follows it. An escaper takes such a value and
+returns one that embeds at a *specific* place in a *specific* format without
+changing the document's structure.
+
+There is no general "escaped string": a value is escaped **for** somewhere.
+The same name that is safe inside a Markdown code span breaks a CSV row, and
+the same value quoted for CSV is meaningless inside an XML attribute. So each
+escaper here names the position it is for and is correct there and nowhere
+else. Two escapers are never applied to the same value for extra safety;
+where a document genuinely contains another, they nest once per layer.
+
+Every escaper accepts any value whose `str()` succeeds — `None` included —
+and returns a string that can be written as UTF-8. Each is verified by
+round-tripping a hostile value through a real parser for its format, in the
+position a consumer would use it, rather than by reading the specification.
+
+## Installation
+
+```bash
+pip install vcti-escapers
+```
+
+### In `requirements.txt`
+
+```
+vcti-escapers>=1.0.0
+```
+
+### In `pyproject.toml` dependencies
+
+```toml
+dependencies = [
+    "vcti-escapers>=1.0.0",
+]
+```
+
+---
+
+## Quick Start
+
+```python
+from vcti.escapers import csv_field, html_attribute, json_string, xml_text
+
+csv_field("failed, retried")  # '"failed, retried"'
+csv_field(138.0)  # '138.0'  — numbers stay bare
+xml_text("a & b")  # 'a &amp; b'
+html_attribute('" onclick="')  # '&quot; onclick=&quot;'
+json_string("</script>")  # '"\\u003c/script\\u003e"'
+```
+
+Every escaper takes any value whose `str()` succeeds, `None` included. What
+absence looks like is the target's decision, so each escaper documents its
+own answer.
+
+```python
+csv_field(None)      # ''    — an empty field
+json_string(None)    # '""'  — an empty JSON string, since null is not one
+```
+
+---
+
+## The escapers
+
+They form one flat pool, grouped here by format for finding rather than
+because a format owns them.
+
+| Format | Escaper | For |
+|---|---|---|
+| Markdown | `markdown_code` | An inline code span in prose — content shown literally, not obeyed |
+| Markdown | `markdown_table_cell` | A code span in a GFM table cell, where `\|` must also be escaped |
+| CSV | `csv_field` | One RFC 4180 field; text quoted, numbers bare |
+| XML | `xml_text` | Character data between tags |
+| XML | `xml_attribute` | Inside an attribute (caller supplies the quotes) |
+| HTML | `html_text` | Ordinary text content between tags |
+| HTML | `html_attribute` | Inside a quoted ordinary attribute (caller supplies the quotes) |
+| JSON | `json_string` | A string literal, quotes included, safe inside `<script>` |
+| URL | `url_path_segment` | One path segment — a slash stays inside it |
+| URL | `url_query_value` | One query parameter value, form-encoded |
+
+A format appears more than once because a format needs different escaping in
+different positions — that distinction is the point, and picking the wrong
+one is the mistake this package exists to prevent. Read each escaper's
+docstring before first use; several carry limits that matter.
+
+Two worth knowing up front:
+
+- **`html_attribute` is for ordinary attributes.** An event handler
+  (`onclick`), a URL attribute (`href`, `src`) or `style` needs more than
+  escaping — a perfectly escaped `javascript:` URL still runs.
+- **Escapers do not chain for extra safety.** They nest, once per layer, when
+  a document genuinely contains another — see
+  [docs/patterns.md](docs/patterns.md).
+
+---
+
+## Using them with a template engine
+
+Escapers are plain functions, so they register wherever a template engine
+takes callables. Nothing here depends on a template engine or knows one
+exists.
+
+```python
+from vcti.escapers import csv_field, markdown_code
+
+filters = {"csv_field": csv_field, "markdown_code": markdown_code}
+# Jinja2:  environment.filters.update(filters)
+```
+
+Registered under their own names, they read the same in a template as in
+Python — `{{ item.name | csv_field }}`.
+
+---
+
+## Dependencies
+
+None.
+
+---
+
+## Documentation
+
+| If you want to… | Read |
+|---|---|
+| See practical, real-world usage | [docs/patterns.md](docs/patterns.md) |
+| Understand the architecture and design decisions | [docs/design.md](docs/design.md) |
+| Navigate and understand the source | [docs/source-guide.md](docs/source-guide.md) |
+| Add an escaper | [docs/extending.md](docs/extending.md) |

vcti_escapers-1.0.0/README.md

@@ -0,0 +1,136 @@
+# Escapers
+
+Escapers for CSV, Markdown, XML, HTML, JSON and URL, each verified against a real parser
+
+## Overview
+
+Text that came from somewhere else — a name, a status, a free-text reason —
+cannot be dropped into a document as it stands. A comma reshapes a CSV row, a
+pipe splits a Markdown table cell, an unescaped quote ends an HTML attribute
+early and starts whatever follows it. An escaper takes such a value and
+returns one that embeds at a *specific* place in a *specific* format without
+changing the document's structure.
+
+There is no general "escaped string": a value is escaped **for** somewhere.
+The same name that is safe inside a Markdown code span breaks a CSV row, and
+the same value quoted for CSV is meaningless inside an XML attribute. So each
+escaper here names the position it is for and is correct there and nowhere
+else. Two escapers are never applied to the same value for extra safety;
+where a document genuinely contains another, they nest once per layer.
+
+Every escaper accepts any value whose `str()` succeeds — `None` included —
+and returns a string that can be written as UTF-8. Each is verified by
+round-tripping a hostile value through a real parser for its format, in the
+position a consumer would use it, rather than by reading the specification.
+
+## Installation
+
+```bash
+pip install vcti-escapers
+```
+
+### In `requirements.txt`
+
+```
+vcti-escapers>=1.0.0
+```
+
+### In `pyproject.toml` dependencies
+
+```toml
+dependencies = [
+    "vcti-escapers>=1.0.0",
+]
+```
+
+---
+
+## Quick Start
+
+```python
+from vcti.escapers import csv_field, html_attribute, json_string, xml_text
+
+csv_field("failed, retried")  # '"failed, retried"'
+csv_field(138.0)  # '138.0'  — numbers stay bare
+xml_text("a & b")  # 'a & b'
+html_attribute('" onclick="')  # '" onclick="'
+json_string("</script>")  # '"\\u003c/script\\u003e"'
+```
+
+Every escaper takes any value whose `str()` succeeds, `None` included. What
+absence looks like is the target's decision, so each escaper documents its
+own answer.
+
+```python
+csv_field(None)      # ''    — an empty field
+json_string(None)    # '""'  — an empty JSON string, since null is not one
+```
+
+---
+
+## The escapers
+
+They form one flat pool, grouped here by format for finding rather than
+because a format owns them.
+
+| Format | Escaper | For |
+|---|---|---|
+| Markdown | `markdown_code` | An inline code span in prose — content shown literally, not obeyed |
+| Markdown | `markdown_table_cell` | A code span in a GFM table cell, where `\|` must also be escaped |
+| CSV | `csv_field` | One RFC 4180 field; text quoted, numbers bare |
+| XML | `xml_text` | Character data between tags |
+| XML | `xml_attribute` | Inside an attribute (caller supplies the quotes) |
+| HTML | `html_text` | Ordinary text content between tags |
+| HTML | `html_attribute` | Inside a quoted ordinary attribute (caller supplies the quotes) |
+| JSON | `json_string` | A string literal, quotes included, safe inside `<script>` |
+| URL | `url_path_segment` | One path segment — a slash stays inside it |
+| URL | `url_query_value` | One query parameter value, form-encoded |
+
+A format appears more than once because a format needs different escaping in
+different positions — that distinction is the point, and picking the wrong
+one is the mistake this package exists to prevent. Read each escaper's
+docstring before first use; several carry limits that matter.
+
+Two worth knowing up front:
+
+- **`html_attribute` is for ordinary attributes.** An event handler
+  (`onclick`), a URL attribute (`href`, `src`) or `style` needs more than
+  escaping — a perfectly escaped `javascript:` URL still runs.
+- **Escapers do not chain for extra safety.** They nest, once per layer, when
+  a document genuinely contains another — see
+  [docs/patterns.md](docs/patterns.md).
+
+---
+
+## Using them with a template engine
+
+Escapers are plain functions, so they register wherever a template engine
+takes callables. Nothing here depends on a template engine or knows one
+exists.
+
+```python
+from vcti.escapers import csv_field, markdown_code
+
+filters = {"csv_field": csv_field, "markdown_code": markdown_code}
+# Jinja2:  environment.filters.update(filters)
+```
+
+Registered under their own names, they read the same in a template as in
+Python — `{{ item.name | csv_field }}`.
+
+---
+
+## Dependencies
+
+None.
+
+---
+
+## Documentation
+
+| If you want to… | Read |
+|---|---|
+| See practical, real-world usage | [docs/patterns.md](docs/patterns.md) |
+| Understand the architecture and design decisions | [docs/design.md](docs/design.md) |
+| Navigate and understand the source | [docs/source-guide.md](docs/source-guide.md) |
+| Add an escaper | [docs/extending.md](docs/extending.md) |

vcti_escapers-1.0.0/pyproject.toml

@@ -0,0 +1,72 @@
+[build-system]
+requires = ["setuptools>=77.0", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "vcti-escapers"
+version = "1.0.0"
+description = "Escapers for CSV, Markdown, XML, HTML, JSON and URL, each verified against a real parser"
+readme = "README.md"
+authors = [
+    {name = "Visual Collaboration Technologies Inc."}
+]
+license = "LicenseRef-Proprietary"
+license-files = ["LICENSE"]
+classifiers = [
+    "Operating System :: OS Independent",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
+]
+requires-python = ">=3.12,<3.15"
+dependencies = []
+
+[project.urls]
+Repository = "https://github.com/vcollab/vcti-python-escapers"
+Changelog = "https://github.com/vcollab/vcti-python-escapers/blob/main/CHANGELOG.md"
+
+[tool.setuptools.packages.find]
+where = ["src"]
+include = ["vcti.escapers", "vcti.escapers.*"]
+
+[tool.setuptools.package-data]
+"vcti.escapers" = ["py.typed"]
+
+[project.optional-dependencies]
+# markdown-it-py and html5lib are the real parsers the escapers are verified
+# against. Markdown and HTML are the two targets with no parser in the
+# standard library, and asserting on an escaper's output text rather than on
+# what a parser makes of it is how two defects reached review.
+test = ["pytest", "pytest-cov", "markdown-it-py", "html5lib"]
+lint = ["ruff"]
+typecheck = ["mypy"]
+
+[tool.pytest.ini_options]
+addopts = "--cov=vcti.escapers --cov-report=term-missing --cov-fail-under=95"
+
+[tool.mypy]
+python_version = "3.12"
+strict = true
+files = ["src"]
+namespace_packages = true
+explicit_package_bases = true
+mypy_path = ["src"]
+
+[tool.coverage.run]
+branch = true
+
+[tool.coverage.report]
+exclude_also = [
+    "raise NotImplementedError",
+    "if TYPE_CHECKING:",
+    "if __name__ == .__main__.:",
+    "@(abc\\.)?abstractmethod",
+    "\\.\\.\\.",
+]
+
+[tool.ruff]
+target-version = "py312"
+line-length = 99
+
+[tool.ruff.lint]
+select = ["E", "F", "W", "I", "UP"]

vcti_escapers-1.0.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

vcti_escapers-1.0.0/src/vcti/escapers/__init__.py

@@ -0,0 +1,73 @@
+# Copyright Visual Collaboration Technologies Inc. All Rights Reserved.
+# See LICENSE for details.
+"""Escapers: functions that render a value safe to embed in one target.
+
+Each escaper is correct for exactly one position and wrong everywhere else.
+A value quoted for a CSV field is meaningless inside an HTML attribute; a
+Markdown code span does not survive a JSON document; and within one format,
+text and attribute positions need different escapers.
+
+**Input domain.** An escaper accepts any value whose ``str()`` succeeds and
+returns a string, ``None`` included. It does not defend against a ``str()``
+that raises - nothing can - and where a target cannot represent a character
+at all, the escaper says so in its own documentation rather than pretending
+otherwise.
+
+**Output guarantee.** What comes back always encodes as UTF-8. A Python
+string can hold a lone surrogate and UTF-8 cannot write one, so an escaper
+that passed one through would return something that raises whenever the
+document is finally written. Each escaper either escapes surrogates, where
+its format has a syntax for it, or drops them, where it does not.
+
+The escapers form one flat pool. They are grouped here by the format they
+target, but that grouping is a way of finding them, not a structure they
+belong to: an escaping rule often serves several formats, and a format often
+needs several escapers for its different positions. Nothing organises around
+one owning format.
+
+Markdown:
+    :func:`markdown_code`, :func:`markdown_table_cell`
+
+CSV:
+    :func:`csv_field`
+
+XML:
+    :func:`xml_text`, :func:`xml_attribute`
+
+HTML:
+    :func:`html_text`, :func:`html_attribute`
+
+JSON:
+    :func:`json_string`
+
+URL:
+    :func:`url_path_segment`, :func:`url_query_value`
+
+See docs/design.md for the contract every escaper here holds to, and for what
+this package deliberately does not do.
+"""
+
+from importlib.metadata import version
+
+from ._csv import csv_field
+from ._html import html_attribute, html_text
+from ._json import json_string
+from ._markdown import markdown_code, markdown_table_cell
+from ._url import url_path_segment, url_query_value
+from ._xml import xml_attribute, xml_text
+
+__version__ = version("vcti-escapers")
+
+__all__ = [
+    "__version__",
+    "csv_field",
+    "html_attribute",
+    "html_text",
+    "json_string",
+    "markdown_code",
+    "markdown_table_cell",
+    "url_path_segment",
+    "url_query_value",
+    "xml_attribute",
+    "xml_text",
+]

vcti_escapers-1.0.0/src/vcti/escapers/_csv.py

@@ -0,0 +1,85 @@
+# Copyright Visual Collaboration Technologies Inc. All Rights Reserved.
+# See LICENSE for details.
+"""Escapers for CSV (RFC 4180).
+
+File layout groups escapers by the format they target. That grouping is a
+finding aid, not the API — every escaper is imported from
+:mod:`vcti.escapers` directly.
+"""
+
+from ._text import without_surrogates
+
+# The characters RFC 4180 requires a field to be quoted for. A value holding
+# one of these cannot be written bare whatever its type says.
+_NEEDS_QUOTING = frozenset(',"\r\n')
+
+
+def csv_field(value: object) -> str:
+    """Render a value as one RFC 4180 field.
+
+    Text is quoted, with embedded quotes doubled, so a comma, a quote or a
+    newline in it cannot reshape the row. Numbers are written bare.
+
+    **Why quoting follows the type rather than the content.** RFC 4180 needs
+    a field quoted only when it holds a comma, a quote or a line break, and
+    most CSV writers quote exactly then. Deciding by type instead keeps a
+    column's quoting stable for the life of a file: a numeric column is never
+    quoted and a text column always is, whatever a particular row happens to
+    contain. That reads predictably in a text editor and diffs cleanly, which
+    matters for a file people review by hand and commit.
+
+    **The type proposes, the rendered text decides.** ``int``, ``float`` and
+    ``bool`` are candidates for going bare, but what they render to is
+    checked for a delimiter first and quoted if it holds one. The type alone
+    is not grounds: these are not sealed types, and a subclass may override
+    ``__str__`` to return anything at all —
+
+    .. code-block:: python
+
+        class Odd(int):
+            def __str__(self) -> str:
+                return "a,b"
+
+    — which on the strength of ``isinstance`` alone would go out bare, split
+    one field into two and reshape the row. Checking the text closes that
+    without giving up the type rule, and a genuine numeric subclass such as
+    ``numpy.float64`` still renders bare as intended.
+
+    For the built-in types themselves the check never fires: ``str()`` of an
+    ``int``, ``float`` or ``bool`` cannot produce a comma, a quote or a line
+    break — including ``inf``, ``nan`` and exponent forms, and regardless of
+    locale, since ``str()`` of a float always renders a ``.`` decimal point.
+    Anything not a candidate is quoted outright, so a type this does not
+    recognise — a ``Decimal``, a tuple whose ``str()`` holds a comma — is
+    quoted rather than left to split the row.
+
+    ``bool`` is handled before ``int`` deliberately, rather than by relying on
+    it being an ``int`` subclass, so that ``True`` rendering bare is a
+    decision this function states rather than an accident of Python's type
+    hierarchy.
+
+    Lone surrogates are dropped: CSV is plain text with no escape syntax that
+    could carry one, and the field has to be writable as UTF-8.
+
+    This deliberately does **not** neutralise a leading ``=``, ``+``, ``-``
+    or ``@``, which some spreadsheets evaluate as a formula. That would be
+    defensive escaping, and it conflicts with lossless escaping: prefixing a
+    quote to disarm a spreadsheet corrupts the value for every other consumer
+    of the same file, and does not stop a spreadsheet that evaluates quoted
+    fields anyway. See ``SECURITY.md``; a caller needing spreadsheet-safe
+    output needs a different escaper, not a flag on this one.
+
+    Args:
+        value: The value to render, of any type.
+
+    Returns:
+        The field, carrying its own quotes when it has them. ``None`` renders
+        as an empty field, which is bare rather than ``""`` — the two parse
+        identically, and sparse columns stay readable.
+    """
+    if value is None:
+        return ""
+    text = without_surrogates(str(value))
+    if isinstance(value, (bool, int, float)) and not _NEEDS_QUOTING.intersection(text):
+        return text
+    return '"' + text.replace('"', '""') + '"'

vcti_escapers-1.0.0/src/vcti/escapers/_html.py

@@ -0,0 +1,142 @@
+# Copyright Visual Collaboration Technologies Inc. All Rights Reserved.
+# See LICENSE for details.
+"""Escapers for HTML.
+
+File layout groups escapers by the format they target. That grouping is a
+finding aid, not the API - every escaper is imported from
+:mod:`vcti.escapers` directly.
+
+**These are for ordinary text and ordinary attribute values only.** Three
+attribute kinds need more than escaping and are not served here:
+
+- **Event handlers** (``onclick`` and friends) hold JavaScript. Escaping for
+  HTML makes the value parse as one attribute; it does nothing about the
+  value then being executed as script. Do not interpolate into one.
+- **URL-bearing attributes** (``href``, ``src``, ``action``) need the scheme
+  checked. ``html_attribute`` will happily escape ``javascript:alert(1)``
+  into a perfectly well-formed attribute that still runs on click. Validate
+  the URL, then escape it.
+- **``style``** holds CSS, which has its own syntax and its own escapes.
+
+See :mod:`vcti.escapers._xml` for why HTML and XML do not share an escaper.
+Both normalise line endings, so both need a carriage return written as a
+reference; where they part company is the rest of the control range, which
+XML forbids outright and HTML mostly tolerates, and the entity set - HTML 4
+never defined ``'``.
+"""
+
+from ._text import without_surrogates
+
+
+def _writable(text: str) -> str:
+    """Settle the two things that are the same in both HTML positions.
+
+    Before any markup is parsed, an HTML parser normalises line endings: a
+    CRLF pair and a lone CR both become a single line feed. A carriage return
+    written literally therefore never reaches the document, in text or in an
+    attribute. Written as a character reference it does, because references
+    are resolved after preprocessing.
+
+    A lone surrogate is dropped rather than passed on. HTML cannot write one
+    - a reference to a surrogate is a parse error - and leaving it in returns
+    a string that raises when the document is encoded as UTF-8, which turns
+    an escaper's output into someone else's error.
+
+    Args:
+        text: The already-escaped text.
+
+    Returns:
+        The text with carriage returns written as character references and
+        lone surrogates removed.
+    """
+    return without_surrogates(text).replace("\r", "
")
+
+
+def html_text(value: object) -> str:
+    """Render a value as HTML text content.
+
+    For text between tags - ``<td>{{ value | html_text }}</td>``. Quotes are
+    left alone: they cannot end an element, and leaving them keeps the source
+    readable. Use :func:`html_attribute` for anything going inside an
+    attribute, where they can.
+
+    This does not sanitise. It makes a value safe to *show*; it does not make
+    untrusted markup safe to render, because there is no markup left - that
+    is the point.
+
+    **Not lossless for two inputs.** U+0000 has no representation at all, and
+    is passed through unchanged because there is nothing better to do with
+    it. What a parser makes of a literal one depends on where it lands: in
+    element text it is **discarded**, and in an attribute value it is
+    **replaced with U+FFFD**.
+
+    Writing it as ``&#0;`` instead would not rescue it - a numeric reference
+    to U+0000 is a parse error that yields U+FFFD, in both positions. So the
+    reference is not "the same as" a literal NUL: it is uniform where the
+    literal is not, and lossy either way. There is no spelling that survives.
+
+    A lone surrogate is dropped here, since HTML has no way to write one
+    either - a reference to a surrogate is also a parse error - and the
+    output has to be writable as UTF-8.
+
+    A carriage return, by contrast, *is* preserved: written as ``&#13;`` it
+    survives the line-ending normalisation that would otherwise turn it into
+    a line feed.
+
+    Args:
+        value: The value to render, of any type.
+
+    Returns:
+        The escaped text. ``None`` renders as the empty string.
+    """
+    if value is None:
+        return ""
+    text = str(value).replace("&", "&amp;").replace("<", "&lt;").replace(">", "&gt;")
+    return _writable(text)
+
+
+def html_attribute(value: object) -> str:
+    """Render a value for inside a quoted HTML attribute.
+
+    Returns the attribute's *content* without delimiters, so the caller
+    supplies the quotes: ``<td title="{{ value | html_attribute }}">``. Both
+    quote characters are escaped, so either delimiter is safe.
+
+    **The caller must quote the attribute.** An unquoted attribute ends at
+    the first space, so no amount of quote escaping protects one - a value
+    with a space in it would introduce a second attribute. Escaping for
+    unquoted attributes would mean encoding whitespace, ``=`` and backticks
+    as well, which no mainstream escaper does; quoting the attribute is the
+    convention every HTML escaper assumes, and it is assumed here.
+
+    **For ordinary attributes only** - not an event handler, not a URL, not
+    ``style``. See this module's own documentation for why each needs more
+    than escaping.
+
+    A single quote becomes ``&#39;`` rather than ``&apos;``, which HTML 4
+    never defined and older parsers show literally. The numeric reference is
+    correct in every HTML version and in XHTML.
+
+    Carriage returns, U+0000 and lone surrogates carry the same caveats as in
+    :func:`html_text`, with one difference worth knowing: U+0000 is replaced
+    with U+FFFD in an attribute value, where in element text it is discarded
+    outright. Neither survives, but they fail differently.
+
+    Args:
+        value: The value to render, of any type.
+
+    Returns:
+        The escaped attribute content, without surrounding quotes. ``None``
+        renders as the empty string.
+    """
+    if value is None:
+        return ""
+    text = (
+        str(value)
+        .replace("&", "&amp;")
+        .replace("<", "&lt;")
+        .replace(">", "&gt;")
+        .replace('"', "&quot;")
+        .replace("'", "&#39;")
+    )
+    return _writable(text)