Merge pull request #145 from jsteuer/master

html escape img alt attribute
yuin · Jul 13, 2020 · b7f25d6 · b7f25d6
2 parents b24f9b4 + b91c802
commit b7f25d6
Show file tree

Hide file tree

Showing 2 changed files with 18 additions and 1 deletion.
diff --git a/_test/extra.txt b/_test/extra.txt
@@ -142,3 +142,20 @@ bbb
 //- - - - - - - - -//
 <p><code>{%</code><em>name</em><code>%}</code></p>
 //= = = = = = = = = = = = = = = = = = = = = = = =//
+
+
+
+12: the alt attribute of img should be escaped
+//- - - - - - - - -//
+!["](quot.jpg)
+!['](apos.jpg)
+![<](lt.jpg)
+![>](gt.jpg)
+![&](amp.jpg) 
+//- - - - - - - - -//
+<p><img src="quot.jpg" alt="&quot;" />
+<img src="apos.jpg" alt="'" />
+<img src="lt.jpg" alt="&lt;" />
+<img src="gt.jpg" alt="&gt;" />
+<img src="amp.jpg" alt="&amp;" /></p>
+//= = = = = = = = = = = = = = = = = = = = = = = =//
diff --git a/renderer/html/html.go b/renderer/html/html.go
@@ -564,7 +564,7 @@ func (r *Renderer) renderImage(w util.BufWriter, source []byte, node ast.Node, e
 		_, _ = w.Write(util.EscapeHTML(util.URLEscape(n.Destination, true)))
 	}
 	_, _ = w.WriteString(`" alt="`)
-	_, _ = w.Write(n.Text(source))
+	_, _ = w.Write(util.EscapeHTML(n.Text(source)))
 	_ = w.WriteByte('"')
 	if n.Title != nil {
 		_, _ = w.WriteString(` title="`)