Skip to content

Commit

Permalink
Fix ampersand escaping
Browse files Browse the repository at this point in the history
  • Loading branch information
exyi committed Nov 19, 2023
1 parent a6c3b17 commit b4b6312
Show file tree
Hide file tree
Showing 2 changed files with 34 additions and 1 deletion.
2 changes: 1 addition & 1 deletion src/Framework/Framework/Controls/HtmlWriter.cs
Original file line number Diff line number Diff line change
Expand Up @@ -515,7 +515,7 @@ private static int IndexOfHtmlEncodingChars(string input, int startIndex, bool e
// An ambiguous ampersand is a U+0026 AMPERSAND character (&) that is followed by one or more ASCII alphanumerics, followed by a U+003B SEMICOLON character (;), where these characters do not match any of the names given in the named character references section.

// so if the next character is not alphanumeric, we can leave it there
if (i == input.Length)
if (i + 1 == input.Length)
return i;
var nextChar = input[i + 1];
if (IsInRange(nextChar, 'a', 'z') ||
Expand Down
33 changes: 33 additions & 0 deletions src/Tests/Runtime/HtmlWriterTests.cs
Original file line number Diff line number Diff line change
Expand Up @@ -42,5 +42,38 @@ public void ImgTagWithChildren()
});
Assert.AreEqual("<img><div></div></img>", text);
}

[TestMethod]
public void EscapingAmpersandStringEnd()
{
var text = WriteHtml(a => {
a.AddAttribute("a", "&");
a.AddAttribute("b", "abc &");
a.RenderSelfClosingTag("img");
});
Assert.AreEqual("<img a=\"&amp;\" b=\"abc &amp;\" />", text);
}

[TestMethod]
public void EscapingAmpersandAllowedUnescaped()
{
var text = WriteHtml(a => {
a.AddAttribute("a", "a & b");
a.AddAttribute("b", "a && b");
a.RenderSelfClosingTag("img");
});
Assert.AreEqual("<img a=\"a & b\" b=\"a && b\" />", text);
}

[TestMethod]
public void EscapingAmpersandUnallowed()
{
var text = WriteHtml(a => {
a.AddAttribute("a", "&amp;");
a.AddAttribute("b", "a&b");
a.RenderSelfClosingTag("img");
});
Assert.AreEqual("<img a=\"&amp;amp;\" b=\"a&amp;b\" />", text);
}
}
}

0 comments on commit b4b6312

Please sign in to comment.