Merge pull request #1155 from sveltejs/ssr-escape-attribute-values

escape attribute values in SSR
sveltejs · Feb 7, 2018 · 0ef8229 · 0ef8229
2 parents 5b9f254 + c481c8d
commit 0ef8229
Show file tree

Hide file tree

Showing 3 changed files with 5 additions and 1 deletion.
diff --git a/src/generators/server-side-rendering/visitors/shared/stringifyAttributeValue.ts b/src/generators/server-side-rendering/visitors/shared/stringifyAttributeValue.ts
@@ -11,7 +11,7 @@ export default function stringifyAttributeValue(block: Block, chunks: Node[]) {
 
 			block.contextualise(chunk.expression);
 			const { snippet } = chunk.metadata;
-			return '${' + snippet + '}';
+			return '${__escape(' + snippet + ')}';
 		})
 		.join('');
 }
diff --git a/test/runtime/samples/attribute-dynamic-quotemarks/_config.js b/test/runtime/samples/attribute-dynamic-quotemarks/_config.js
@@ -0,0 +1,3 @@
+export default {
+	html: `<span title='"foo"'>foo</span>`
+};
diff --git a/test/runtime/samples/attribute-dynamic-quotemarks/main.html b/test/runtime/samples/attribute-dynamic-quotemarks/main.html
@@ -0,0 +1 @@
+<span title='{{"\"foo\""}}'>foo</span>