Escape < in XML attributes

jhy · jhy · commit a025d87deb9c · 2015-07-13T23:11:21.000-07:00
Fixes jhy#528
diff --git a/CHANGES b/CHANGES
@@ -28,6 +28,9 @@ jsoup changelog
    rules as a URL read from Nodes.absUrl(String).
    <https://github.com/jhy/jsoup/issues/585>
 
+ * When serialising XML, ensure that '<' characters in attributes are escaped, per spec. Not required in HTML.
+   <https://github.com/jhy/jsoup/issues/528>
+
 *** Release 1.8.2 [2015-Apr-13]
  * Performance improvements for parsing HTML on Android, of 1.5x to 1.9x, with larger parses getting a bigger
    speed increase. For non-Android JREs, around 1.1x to 1.2x.
diff --git a/src/main/java/org/jsoup/nodes/Entities.java b/src/main/java/org/jsoup/nodes/Entities.java
@@ -118,7 +118,8 @@ static void escape(StringBuilder accum, String string, Document.OutputSettings o
                             accum.append("&#xa0;");
                         break;
                     case '<':
-                        if (!inAttribute)
+                        // escape when in character data or when in a xml attribue val; not needed in html attr val
+                        if (!inAttribute || escapeMode == EscapeMode.xhtml)
                             accum.append("&lt;");
                         else
                             accum.append(c);
diff --git a/src/test/java/org/jsoup/nodes/EntitiesTest.java b/src/test/java/org/jsoup/nodes/EntitiesTest.java
@@ -14,7 +14,7 @@ public class EntitiesTest {
         String escapedAscii = Entities.escape(text, new OutputSettings().charset("ascii").escapeMode(base));
         String escapedAsciiFull = Entities.escape(text, new OutputSettings().charset("ascii").escapeMode(extended));
         String escapedAsciiXhtml = Entities.escape(text, new OutputSettings().charset("ascii").escapeMode(xhtml));
-        String escapedUtfFull = Entities.escape(text, new OutputSettings().charset("UTF-8").escapeMode(base));
+        String escapedUtfFull = Entities.escape(text, new OutputSettings().charset("UTF-8").escapeMode(extended));
         String escapedUtfMin = Entities.escape(text, new OutputSettings().charset("UTF-8").escapeMode(xhtml));
 
         assertEquals("Hello &amp;&lt;&gt; &Aring; &aring; &#x3c0; &#x65b0; there &frac34; &copy; &raquo;", escapedAscii);
@@ -86,4 +86,19 @@ public class EntitiesTest {
         String string = "http://www.foo.com?a=1&num_rooms=1&children=0&int=VA&b=2";
         assertEquals(string, Entities.unescape(string));
     }
+
+    @Test public void escapesGtInXmlAttributesButNotInHtml() {
+        // https://github.com/jhy/jsoup/issues/528 - < is OK in HTML attribute values, but not in XML
+
+
+        String docHtml = "<a title='<p>One</p>'>One</a>";
+        Document doc = Jsoup.parse(docHtml);
+        Element element = doc.select("a").first();
+
+        doc.outputSettings().escapeMode(base);
+        assertEquals("<a title=\"<p>One</p>\">One</a>", element.outerHtml());
+
+        doc.outputSettings().escapeMode(xhtml);
+        assertEquals("<a title=\"&lt;p>One&lt;/p>\">One</a>", element.outerHtml());
+    }
 }
