Merge pull request GrapesJS#939 from ryandeba/escape-attributes

escpae quotes in Component.toHTML
ryandeba · Mar 10, 2018 · a36ddc9 · a36ddc9
2 parents e6395e2 + ff15c34
commit a36ddc9
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 1 deletion.
diff --git a/src/dom_components/model/Component.js b/src/dom_components/model/Component.js
@@ -670,7 +670,7 @@ const Component = Backbone.Model.extend(Styleable).extend(
       const attributes = this.getAttrToHTML();
 
       for (let attr in attributes) {
-        const value = attributes[attr];
+        const value = attributes[attr].replace(/"/g, '&quot;');
 
         if (!isUndefined(value)) {
           attrs.push(`${attr}="${value}"`);

diff --git a/test/specs/dom_components/model/Component.js b/test/specs/dom_components/model/Component.js
@@ -135,6 +135,16 @@ module.exports = {
         expect(obj.toHTML()).toEqual('<div/>');
       });
 
+      it('Component toHTML with quotes in attribute', () => {
+        obj = new Component();
+        let attrs = obj.get('attributes');
+        attrs['data-test'] = '"value"';
+        obj.set('attributes', attrs);
+        expect(obj.toHTML()).toEqual(
+          '<div data-test="&quot;value&quot;"></div>'
+        );
+      });
+
       it('Component parse empty div', () => {
         var el = document.createElement('div');
         obj = Component.isComponent(el);