From 8b445f1608b3d2fddc693e6832ee6741f97a81fb Mon Sep 17 00:00:00 2001
From: Martin Kouba <mkouba@redhat.com>
Date: Wed, 17 Jan 2024 16:10:05 +0100
Subject: [PATCH] Qute: fix UserTagSectionHelper.Arguments.asHtmlAttributes()

- resolves #38251
---
 .../io/quarkus/qute/UserTagSectionHelper.java | 28 ++++++++++++-------
 .../java/io/quarkus/qute/UserTagTest.java     |  7 +++--
 2 files changed, 23 insertions(+), 12 deletions(-)

diff --git a/independent-projects/qute/core/src/main/java/io/quarkus/qute/UserTagSectionHelper.java b/independent-projects/qute/core/src/main/java/io/quarkus/qute/UserTagSectionHelper.java
index 5781d6d52d82c..e0f3d9ef1e8c8 100644
--- a/independent-projects/qute/core/src/main/java/io/quarkus/qute/UserTagSectionHelper.java
+++ b/independent-projects/qute/core/src/main/java/io/quarkus/qute/UserTagSectionHelper.java
@@ -16,10 +16,13 @@ public class UserTagSectionHelper extends IncludeSectionHelper implements Sectio
 
     protected final boolean isNestedContentNeeded;
 
+    private final HtmlEscaper htmlEscaper;
+
     UserTagSectionHelper(Supplier<Template> templateSupplier, Map<String, SectionBlock> extendingBlocks,
-            Map<String, Expression> parameters, boolean isIsolated, boolean isNestedContentNeeded) {
+            Map<String, Expression> parameters, boolean isIsolated, boolean isNestedContentNeeded, HtmlEscaper htmlEscaper) {
         super(templateSupplier, extendingBlocks, parameters, isIsolated);
         this.isNestedContentNeeded = isNestedContentNeeded;
+        this.htmlEscaper = htmlEscaper;
     }
 
     @Override
@@ -29,7 +32,7 @@ protected boolean optimizeIfNoParams() {
 
     @Override
     protected void addAdditionalEvaluatedParams(SectionResolutionContext context, Map<String, Object> evaluatedParams) {
-        evaluatedParams.put(Factory.ARGS, new Arguments(evaluatedParams));
+        evaluatedParams.put(Factory.ARGS, new Arguments(evaluatedParams, htmlEscaper));
         if (isNestedContentNeeded) {
             // If needed then add the {nested-content} to the evaluated params
             Expression nestedContent = ((TemplateImpl) template.get()).findExpression(this::isNestedContent);
@@ -56,6 +59,7 @@ public static class Factory extends IncludeSectionHelper.AbstractIncludeFactory<
 
         private final String name;
         private final String templateId;
+        private final HtmlEscaper htmlEscaper;
 
         /**
          *
@@ -65,6 +69,7 @@ public static class Factory extends IncludeSectionHelper.AbstractIncludeFactory<
         public Factory(String name, String templateId) {
             this.name = name;
             this.templateId = templateId;
+            this.htmlEscaper = new HtmlEscaper(List.of());
         }
 
         @Override
@@ -108,7 +113,7 @@ protected UserTagSectionHelper newHelper(Supplier<Template> template, Map<String
             return new UserTagSectionHelper(template, extendingBlocks, params,
                     isolatedValue != null ? isolatedValue
                             : Boolean.parseBoolean(context.getParameterOrDefault(ISOLATED, ISOLATED_DEFAULT_VALUE)),
-                    isNestedContentNeeded);
+                    isNestedContentNeeded, htmlEscaper);
         }
 
         @Override
@@ -129,16 +134,19 @@ protected void handleParamInit(String key, String value, SectionInitContext cont
     public static class Arguments implements Iterable<Entry<String, Object>> {
 
         private final List<Entry<String, Object>> args;
+        private final HtmlEscaper htmlEscaper;
 
-        Arguments(Map<String, Object> map) {
+        Arguments(Map<String, Object> map, HtmlEscaper htmlEscaper) {
             this.args = new ArrayList<>(Objects.requireNonNull(map).size());
             map.entrySet().forEach(args::add);
             // sort by key
             this.args.sort(Comparator.comparing(Entry::getKey));
+            this.htmlEscaper = htmlEscaper;
         }
 
-        private Arguments(List<Entry<String, Object>> args) {
+        private Arguments(List<Entry<String, Object>> args, HtmlEscaper htmlEscaper) {
             this.args = args;
+            this.htmlEscaper = htmlEscaper;
         }
 
         public boolean isEmpty() {
@@ -171,7 +179,7 @@ public Arguments skip(String... keys) {
                     newArgs.add(e);
                 }
             }
-            return new Arguments(newArgs);
+            return new Arguments(newArgs, htmlEscaper);
         }
 
         public Arguments filter(String... keys) {
@@ -182,23 +190,23 @@ public Arguments filter(String... keys) {
                     newArgs.add(e);
                 }
             }
-            return new Arguments(newArgs);
+            return new Arguments(newArgs, htmlEscaper);
         }
 
         // foo="1" bar="true"
-        public String asHtmlAttributes() {
+        public RawString asHtmlAttributes() {
             StringBuilder builder = new StringBuilder();
             for (Iterator<Entry<String, Object>> it = args.iterator(); it.hasNext();) {
                 Entry<String, Object> e = it.next();
                 builder.append(e.getKey());
                 builder.append("=\"");
-                builder.append(e.getValue());
+                builder.append(htmlEscaper.escape(String.valueOf(e.getValue())));
                 builder.append("\"");
                 if (it.hasNext()) {
                     builder.append(" ");
                 }
             }
-            return builder.toString();
+            return new RawString(builder.toString());
         }
 
     }
diff --git a/independent-projects/qute/core/src/test/java/io/quarkus/qute/UserTagTest.java b/independent-projects/qute/core/src/test/java/io/quarkus/qute/UserTagTest.java
index 08e8dd538fb21..33238c9e6ce27 100644
--- a/independent-projects/qute/core/src/test/java/io/quarkus/qute/UserTagTest.java
+++ b/independent-projects/qute/core/src/test/java/io/quarkus/qute/UserTagTest.java
@@ -165,10 +165,12 @@ public void testArguments() {
                 .addSectionHelper(new UserTagSectionHelper.Factory("myTag1", "my-tag-1"))
                 .addSectionHelper(new UserTagSectionHelper.Factory("myTag2", "my-tag-2"))
                 .addSectionHelper(new UserTagSectionHelper.Factory("gravatar", "gravatar-tag"))
+                .addResultMapper(new HtmlEscaper(ImmutableList.of("text/html")))
                 .strictRendering(false)
                 .build();
         Template tag1 = engine.parse(
-                "{_args.size}::{_args.empty}::{_args.get('foo').or('bar')}::{_args.asHtmlAttributes}::{_args.skip('foo','baz').size}::{#each _args.filter('foo')}{it.value}{/each}");
+                "{_args.size}::{_args.empty}::{_args.get('foo').or('bar')}::{_args.asHtmlAttributes}::{_args.skip('foo','baz').size}::{#each _args.filter('foo')}{it.value}{/each}",
+                Variant.forContentType(Variant.TEXT_HTML));
         engine.putTemplate("my-tag-1", tag1);
         Template tag2 = engine.parse(
                 "{#each _args}{it.key}=\"{it.value}\"{#if it_hasNext} {/if}{/each}");
@@ -178,7 +180,8 @@ public void testArguments() {
 
         Template template = engine.parse("{#myTag1 /}");
         assertEquals("0::true::bar::::0::", template.render());
-        assertEquals("2::false::1::bar=\"true\" foo=\"1\"::1::1", engine.parse("{#myTag1 foo=1 bar=true /}").render());
+        assertEquals("3::false::1::bar=\"true\" baz=\"&quot;\" foo=\"1\"::1::1",
+                engine.parse("{#myTag1 foo=1 bar=true baz=quotationMark /}").data("quotationMark", "\"").render());
 
         assertEquals("baz=\"false\" foo=\"1\"", engine.parse("{#myTag2 foo=1 baz=false /}").render());