diff --git a/_test/extra.txt b/_test/extra.txt index ead2da3..4f9499c 100644 --- a/_test/extra.txt +++ b/_test/extra.txt @@ -142,3 +142,20 @@ bbb //- - - - - - - - -//

{%name%}

//= = = = = = = = = = = = = = = = = = = = = = = =// + + + +12: the alt attribute of img should be escaped +//- - - - - - - - -// +!["](quot.jpg) +!['](apos.jpg) +![<](lt.jpg) +![>](gt.jpg) +![&](amp.jpg) +//- - - - - - - - -// +

" +' +< +> +&

+//= = = = = = = = = = = = = = = = = = = = = = = =// diff --git a/renderer/html/html.go b/renderer/html/html.go index 537a256..e545a73 100644 --- a/renderer/html/html.go +++ b/renderer/html/html.go @@ -564,7 +564,7 @@ func (r *Renderer) renderImage(w util.BufWriter, source []byte, node ast.Node, e _, _ = w.Write(util.EscapeHTML(util.URLEscape(n.Destination, true))) } _, _ = w.WriteString(`" alt="`) - _, _ = w.Write(n.Text(source)) + _, _ = w.Write(util.EscapeHTML(n.Text(source))) _ = w.WriteByte('"') if n.Title != nil { _, _ = w.WriteString(` title="`)