Unescape HTML entities in the URLs extracted from attributes

package.json

@@ -36,6 +36,7 @@
     "clean-css": "1.1.7",
     "cli-color": "^0.3.2",
     "datauri": "~0.2.0",
+    "lodash": "^3.10.1",
     "request": "^2.49.0",
     "uglify-js": "^2.4.1",
     "xtend": "^4.0.0"

src/html.js

@@ -2,6 +2,7 @@
 
 var path = require( "path" );
 var UglifyJS = require( "uglify-js" );
+var _ = require( "lodash" );
 var xtend = require( "xtend" );
 var async = require( "async" );
 var inline = require( "./util" );
@@ -108,48 +109,51 @@ module.exports = function( options, callback )
     var tasks = [];
     var found;
 
-    var scriptRegex = /<script[\s\S]+?src=["']([^"']+?)["'][\s\S]*?>\s*<\/script>/g;
+    var inlineAttributeRegex = new RegExp( settings.inlineAttribute, "gi" );
+    var inlineAttributeIgnoreRegex = new RegExp( settings.inlineAttribute + "-ignore", "gi" );
+
+    var scriptRegex = /<script\b[\s\S]+?\bsrc\s*=\s*("|')([\s\S]+?)\1[\s\S]*?>\s*<\/script>/gi;
     while( ( found = scriptRegex.exec( result ) ) !== null )
     {
-        if( !found[ 0 ].match( new RegExp( settings.inlineAttribute + "-ignore", "gi" ) )
-            && ( settings.scripts || found[ 0 ].match( new RegExp( settings.inlineAttribute, "gi" ) ) ) )
+        if( !inlineAttributeIgnoreRegex.test( found[ 0 ] )
+            && ( settings.scripts || inlineAttributeRegex.test( found[ 0 ] ) ) )
         {
             tasks.push( replaceScript.bind(
             {
                 element: found[ 0 ],
-                src: found[ 1 ],
+                src: _.unescape(found[ 2 ]).trim(),
                 attrs: inline.getAttrs( found[ 0 ], settings ),
                 limit: settings.scripts
             } ) );
         }
     }
 
-    var linkRegex = /<link[\s\S]+?href=["']([^"']+?)["'][\s\S]*?\/?>/g;
+    var linkRegex = /<link\b[\s\S]+?\bhref\s*=\s*("|')([\s\S]+?)\1[\s\S]*?>/gi;
     while( ( found = linkRegex.exec( result ) ) !== null )
     {
-        if( !found[ 0 ].match( new RegExp( settings.inlineAttribute + "-ignore", "gi" ) )
-            && ( settings.links || found[ 0 ].match( new RegExp( settings.inlineAttribute, "gi" ) ) ) )
+        if( !inlineAttributeIgnoreRegex.test( found[ 0 ] )
+            && ( settings.links || inlineAttributeRegex.test( found[ 0 ] ) ) )
         {
             tasks.push( replaceLink.bind(
             {
                 element: found[ 0 ],
-                src: found[ 1 ],
+                src: _.unescape(found[ 2 ]).trim(),
                 attrs: inline.getAttrs( found[ 0 ], settings ),
                 limit: settings.links
             } ) );
         }
     }
 
-    var imgRegex = /<img[\s\S]+?src=["']([^"']+?)["'][\s\S]*?\/?\s*?>/g;
+    var imgRegex = /<img\b[\s\S]+?\bsrc\s*=\s*("|')([\s\S]+?)\1[\s\S]*?>/gi;
     while( ( found = imgRegex.exec( result ) ) !== null )
     {
-        if( !found[ 0 ].match( new RegExp( settings.inlineAttribute + "-ignore", "gi" ) )
-            && ( settings.images || found[ 0 ].match( new RegExp( settings.inlineAttribute, "gi" ) ) ) )
+        if( !inlineAttributeIgnoreRegex.test( found[ 0 ] )
+            && ( settings.images || inlineAttributeRegex.test( found[ 0 ] ) ) )
         {
             tasks.push( replaceImg.bind(
             {
                 element: found[ 0 ],
-                src: found[ 1 ],
+                src: _.unescape(found[ 2 ]).trim(),
                 attrs: inline.getAttrs( found[ 0 ], settings ),
                 limit: settings.images
             } ) );

test/spec.js

@@ -1,7 +1,6 @@
 var assert = require('assert');
 var fs = require('fs');
 var path = require('path');
-var http = require('http');
 var inline = require('../src/inline.js');
 var util = require('../src/util.js');
 var fauxJax = require('faux-jax');
@@ -304,14 +303,14 @@ describe('html', function() {
         );
     });
 
-    describe('(using mocks)', function() {
+    describe('(http mocking)', function() {
         var baseUrl = 'http://example.com/';
 
         beforeEach(function() {
             fauxJax.install();
             fauxJax.on('request', function(request) {
                 assert.equal(request.requestURL.indexOf(baseUrl), 0);
-                var relativePath = request.requestURL.slice(baseUrl.length);
+                var relativePath = request.requestURL.slice(baseUrl.length).replace(/\?.*/, '');
                 var headers = {
                     'Content-Type': mime.contentType(path.extname(relativePath)) || 'application/octet-stream'
                 };
@@ -334,6 +333,38 @@ describe('html', function() {
                 testEquality(err, result, expected, done);
             });
         });
+
+        it('should unescape HTML entities when extracting URLs from attributes', function(done) {
+            fauxJax.on('request', function(request) {
+                assert(!/&\w+;/.test(request.url));
+            });
+            inline.html({
+                fileContent: '<img src="assets/icon.png?a=b&amp;c=\'d\'" /><img src="assets/icon.png?a=b&amp;c=\'d\'&amp;&amp;">',
+                relativeTo: baseUrl,
+                images: true
+            }, done);
+        });
+
+        it('should understand the spaces to the sides of = when parsing attributes', function(done) {
+            var count = 0;
+            fauxJax.on('request', function(request) {
+                count++;
+            });
+            inline.html({
+                fileContent: '<img src = "assets/icon.png">' +
+                    '<script src ="assets/export.js"></script>' +
+                    '<script src =\n"assets/export.js?foo=1"></script>' +
+                    '<link href=  "assets/simple.css" rel="stylesheet"/>',
+                relativeTo: baseUrl,
+                scripts: true,
+                links: true,
+                images: true
+            }, function() {
+                assert.equal(count, 4);
+                done();
+            });
+        });
+
     });
 });